Artillery Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Artillery (ART) is a BEP-20 token on BNB Chain whose transfer code blocks every transfer into one hidden address, except transfers sent by the owner. The address is stored in a private variable nxOwner and filled automatically by the first transferFrom call, which for a new token is normally the router moving tokens into the PancakeSwap pair when liquidity is added. Once that address is the pair, buys still work but any sell to the pair reverts with "Order TransferFromMiddleware".

renounceOwnership clears only _owner; the deployer stays authorised through a second variable, _leaveowner, and a function misleadingly named transferOwnership re-points the blocked address. De.Fi's REKT database lists Artillery as a honeypot, and its listing cites a 5 May 2021 Token Sniffer post saying the contracts it flagged block transfers to the LP address.

How it happened

  1. The deployer holds the full supply of 100,000,000 ART and is recorded as both _owner and _leaveowner; nxOwner starts as the zero address.
  2. Every transfer runs the PancakeSwabV2Interface modifier. On the first transferFrom from a non-zero sender it sets nxOwner = to, so if that call is the liquidity add, the pair becomes the blocked address.
  3. After that, every transfer whose recipient is nxOwner must come from _owner or it reverts. Buyers receive ART from the pair normally, but a sell, which sends ART to the pair, fails.
  4. Calling renounceOwnership sets _owner to zero. That makes the owner check impossible to pass, so no one can sell to the pair, while _leaveowner can still pass onlyOwner.
  5. Through transferOwnership, which only writes nxOwner, the _leaveowner account can move the block to any other address. previousOwner(), the getter for the blocked address, is itself restricted to the owner, so holders cannot easily see which address is blocked.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ART

Evidence

Same attack technique

Browse all hacks →
BNB Chain Bafe.io Loss not disclosed BNB Chain Koshka Miu Loss not disclosed Ethereum Formation Finance Loss not disclosed Ethereum Nagasaki Shiba Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes