Bafe.io Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Bafe.io (BAFE) is a BNB Smart Chain token contract deployed on 2021-03-31 by 0x63171f5e…D5105A in transaction 0xbfff1a08…3bb1e9. De.Fi's REKT database lists it as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. The source header advertises a 10% fee split between holder reflection and liquidity burn, but the code contains no fee, reflection or burn logic.

Instead, transferFrom requires a per-address allow flag that only the deployer has by default, so a router-style sale that pulls tokens with transferFrom reverts for ordinary holders, while an owner-gated addAllow can switch the flag for any address and mint can overwrite any balance.

How it happened

  1. The constructor gives the whole supply to the deployer and flags only that address: balances[msg.sender] = totalSupply; allow[msg.sender] = true;.
  2. transfer has no extra check, so wallet-to-wallet transfers, and a buy where the pair sends tokens out with transfer, are not affected.
  3. transferFrom adds require(allow[_from] == true);. A sale through a router pulls the holder's tokens into the pair with transferFrom(holder, pair, amount), so it reverts for every holder whose allow flag is false, which is the default for every address except the deployer.
  4. addAllow(address holder, bool allowApprove) external onlyOwner writes allow[holder] = allowApprove, so one address can open or close the sell path per holder.
  5. The onlyOwner modifier does not read the owner variable. It is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which converts to 0xbd486897…439192, a different address from the deployer. transferOwnership changes owner but cannot change who passes this modifier.
  6. mint(address miner, uint256 _value) is also onlyOwner and sets balances[miner] = _value. It overwrites a balance (up or down), does not update totalSupply and emits no event.
  7. What the code allows is separate from what happened: De.Fi's REKT database lists the token as a honeypot, but no transaction showing addAllow, mint or a failed sale was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BAFE

Evidence

Same attack technique

Browse all hacks →
BNB Chain Excavator Loss not disclosed Ethereum NFTify Loss not disclosed BNB Chain Koshka Miu Loss not disclosed BNB Chain Artillery Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes