ArgonNetwork Honeypot
What happened
ArgonNetwork (AGN) is a BEP-20 token whose internal _approve function only records an allowance when the token owner is one hard-coded address, 0xeB61e4d45f9a3a1a1337fbb8195c46cEF3DAeF90; for every other holder it stores an allowance of 0 and emits an Approval event with the value 4. Because transferFrom subtracts the transferred amount from that allowance, any transferFrom for a non-exempt holder reverts, which is the call a router makes when a holder sells. Plain transfer calls do not use the allowance.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance and describes it as a contract whose owner could disable the transfer function, which restricted users in selling their tokens. No transaction hash, attacker address or loss figure is available for this record.
How it happened
What the code allows:
- The constructor credits the deployer with the whole supply:
_totalSupply = 1000000000000000;and_balances[msg.sender] = _totalSupply;(6 decimals, so 1,000,000,000 AGN).Ownablemakes the deployer the owner, andmint(uint256 amount) public onlyOwnercan mint more to the owner. _approvebranches on a hard-coded address:if (owner == address(0xeB61e4d45f9a3a1a1337fbb8195c46cEF3DAeF90)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 4); }. For every other holder,approveandincreaseAllowanceleave the allowance at zero, while the event log shows anApprovalwith a non-zero value of4.transferFromruns_transfer(sender, recipient, amount);and then_approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"));. For a non-exemptsenderthe stored allowance is always0, so for anyamountabove zero thesubreverts and the whole call, including the balance change, is undone.- Buys are not affected by this check, because a pair pays the buyer with
transfer, andtransfercalls_transferdirectly. A holder who sells through a router needstransferFromon their own tokens and so cannot complete the sale. The hard-coded address is exempt from this restriction. - The exemption is a literal in
_approve, not tied toowner():renounceOwnershipandtransferOwnershipchange theonlyOwnerpowers but not which address is exempt.
De.Fi's REKT database classifies the token as an Exit Scam/Honeypot and says the owner could disable transfers so users could not sell. A security write-up opened for this review describes the same hard-coded-address _approve pattern in other BSC tokens, with a different address, not in this contract. The source alone does not show any failed sale or liquidity removal, so no transaction is cited.
Protocol details
Evidence
- report De.Fi REKT database listing, proof link (Token Sniffer tweet; could not be opened) twitter.com
- address BscScan verified source: ArgonNetwork 0xe9746291c3d005e49365af763e1b6d43c5c8e684 bscscan.com
- analysis Scam explained: BSC NoApproval (cryptot3ddybear blog) cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0xe9746291c3d005e49365af763e1b6d43c5c8e684 (ArgonNetwork.sol) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.