Atmosphere Honeypot

What happened

Atmosphere (ATMO) is a BNB Smart Chain BEP20 token whose _approve function records an allowance only when the approving address is one hard-coded address, 0x38321682…912752. For every other holder an approval is stored as 0 while an Approval event with value 5 is emitted, so a DEX that needs to pull tokens with transferFrom cannot be authorised and the call reverts. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-24, saying holders were restricted in selling.

The listing gives no loss amount, and the code alone does not show whether any holder was blocked.

How it happened

1. The constructor sets _name = "Atmosphere", _symbol = "ATMO", _decimals = 3 and _totalSupply = 2000000000000 (2,000,000,000 tokens), all credited to msg.sender. The on-chain owner and the deployer are both 0x38321682…912752.
2. Every allowance write goes through _approve, including approve, increaseAllowance and the allowance reduction inside transferFrom. It contains if (owner == address(0x38321682c94c25caA400192de3a433C25E912752)) { which stores _allowances[owner][spender] = amount; only for that address.
3. For any other holder the else branch runs: _allowances[owner][spender] = 0; emit Approval(owner, spender, 5);. A holder who approves a router sees an Approval event but the stored allowance stays 0.
4. transferFrom runs _transfer(sender, recipient, amount); and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"));. With a stored allowance of 0, the sub reverts for any amount above 0, which undoes the transfer. A sale through a DEX, which pulls tokens with transferFrom, therefore fails for non-hard-coded holders.
5. transfer has no allowance step, so tokens can still move by direct transfer and a pair can send tokens out to a buyer. Allowances set by the hard-coded address are stored normally. mint(uint256) is onlyOwner and credits the owner, and renounceOwnership exists, but the hard-coded address check does not depend on owner().

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ATMO

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing for ATMO (Token Sniffer proof link not retrievable) twitter.com
• address BscScan verified source, Atmosphere (ATMO) bscscan.com
• analysis Sourcify match, 0xbd82be8d12f19c219f94f4593499367e6da17a14 repo.sourcify.dev
• analysis Scam explained: BSC NoApproval cryptot3ddybear.gitlab.io