Bee-Swap.org Honeypot
What happened
Bee-Swap.org (BEES) is a BEP-20 token deployed on BNB Chain on 1 March 2021 at 0x4b9e79ae…7ca5cf. Its verified code lets the owner mark any address with setPanCakeSwapReciever; every transfer to a marked address then reverts with "Error: Can not sell this token". Marking the PancakeSwap pair would make every sale to the pool fail while buys from it keep working.
The flag is not covered by renounceWhitelist, and the owner can set or clear it at any time. De.Fi's REKT database lists the token as an exit scam/honeypot.
How it happened
- The constructor mints the entire 9,000,000,000,000,000 BEES supply to the deployer and makes it the owner and
feeDistributor. The contract has no mint function. - The owner can call
setPanCakeSwapReciever(address _recipient, bool _feeless)to setPanCakeSwapReciever[_recipient]for any address. Unlike the feeless whitelist setters, this one has nocanWhitelistcheck, sorenounceWhitelistdoes not disable it. - Every
transferandtransferFromruns_transfer, which first debits the sender and then callscalculateFeesBeforeSend. That function reverts with "Error: Can not sell this token" whenever the recipient is marked, which undoes the whole transfer. - A PancakeSwap sale moves the seller's tokens to the pair through
transferFrom, so once the pair is marked every sale reverts. Buys, where the pair is the sender, are not checked and still succeed. - The check has no owner exemption, but the owner can clear the flag, sell, and set it again. The
txFeesetter is cosmetic:calculateFeesBeforeSendalways returns(amount, 0), so no fee is ever charged.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.