Aragorn Honeypot

What happened

Aragorn (ARGN) is a BNB Chain token deployed on 5 April 2021 at 0x11c68bfe…b86651. Its transfer function has no restriction, so buys out of a PancakeSwap pool arrive normally, but transferFrom requires allow[_from] == true, and the constructor sets that flag only for the deployer. PancakeSwap router sales pull tokens with transferFrom, so for every other holder a normal sale reverts.

The admin checked by onlyOwner is a hard-coded address, 0xbd486897…439192, which can add wallets to the allowlist with addAllow and can overwrite any balance with mint. De.Fi's REKT database lists ARGN as an exit scam/honeypot.

How it happened

1. The constructor credits the whole supply to the deployer and sets allow[msg.sender] = true; for that address only.
2. transfer checks only the destination and the sender's balance, so the pool can send bought tokens to any buyer.
3. A sale through the router moves tokens with transferFrom(holder, pair, amount), which runs require(allow[_from] == true);. Ordinary holders are not on the list, so the call reverts even with a valid approval.
4. onlyOwner compares msg.sender to a hard-coded address (decimal 1080614020421183795110940285280029773222128095634, 0xbd486897…439192), not to the stored owner variable. That address can call addAllow(holder, bool) to let chosen wallets sell and mint(miner, _value), which sets balances[miner] = _value without changing totalSupply.
5. transferOwnership only changes the unused owner variable, and there is no renounce function, so these powers stay with the hard-coded address.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ARGN

Evidence

• report Token Sniffer post 1373698524961906691 (seed link) twitter.com
• transaction Aragorn contract creation transaction bscscan.com
• address Aragorn (ARGN) verified contract code on BscScan bscscan.com
• analysis Sourcify exact match for 0x11c68bfe183d899cac6fca1d566f2b449db86651 on BNB Chain repo.sourcify.dev