ArgonNetwork Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ArgonNetwork (AGN) is a BEP-20 token whose internal _approve function only records an allowance when the token owner is one hard-coded address, 0xeB61e4d45f9a3a1a1337fbb8195c46cEF3DAeF90; for every other holder it stores an allowance of 0 and emits an Approval event with the value 4. Because transferFrom subtracts the transferred amount from that allowance, any transferFrom for a non-exempt holder reverts, which is the call a router makes when a holder sells. Plain transfer calls do not use the allowance.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance and describes it as a contract whose owner could disable the transfer function, which restricted users in selling their tokens. No transaction hash, attacker address or loss figure is available for this record.

How it happened

What the code allows:

  1. The constructor credits the deployer with the whole supply: _totalSupply = 1000000000000000; and _balances[msg.sender] = _totalSupply; (6 decimals, so 1,000,000,000 AGN). Ownable makes the deployer the owner, and mint(uint256 amount) public onlyOwner can mint more to the owner.
  2. _approve branches on a hard-coded address: if (owner == address(0xeB61e4d45f9a3a1a1337fbb8195c46cEF3DAeF90)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 4); }. For every other holder, approve and increaseAllowance leave the allowance at zero, while the event log shows an Approval with a non-zero value of 4.
  3. transferFrom runs _transfer(sender, recipient, amount); and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"));. For a non-exempt sender the stored allowance is always 0, so for any amount above zero the sub reverts and the whole call, including the balance change, is undone.
  4. Buys are not affected by this check, because a pair pays the buyer with transfer, and transfer calls _transfer directly. A holder who sells through a router needs transferFrom on their own tokens and so cannot complete the sale. The hard-coded address is exempt from this restriction.
  5. The exemption is a literal in _approve, not tied to owner(): renounceOwnership and transferOwnership change the onlyOwner powers but not which address is exempt.

De.Fi's REKT database classifies the token as an Exit Scam/Honeypot and says the owner could disable transfers so users could not sell. A security write-up opened for this review describes the same hard-coded-address _approve pattern in other BSC tokens, with a different address, not in this contract. The source alone does not show any failed sale or liquidity removal, so no transaction is cited.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract AGN

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.