Bee-Swap.org Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Bee-Swap.org (BEES) is a BEP-20 token deployed on BNB Chain on 1 March 2021 at 0x4b9e79ae…7ca5cf. Its verified code lets the owner mark any address with setPanCakeSwapReciever; every transfer to a marked address then reverts with "Error: Can not sell this token". Marking the PancakeSwap pair would make every sale to the pool fail while buys from it keep working.

The flag is not covered by renounceWhitelist, and the owner can set or clear it at any time. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor mints the entire 9,000,000,000,000,000 BEES supply to the deployer and makes it the owner and feeDistributor. The contract has no mint function.
  2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless) to set PanCakeSwapReciever[_recipient] for any address. Unlike the feeless whitelist setters, this one has no canWhitelist check, so renounceWhitelist does not disable it.
  3. Every transfer and transferFrom runs _transfer, which first debits the sender and then calls calculateFeesBeforeSend. That function reverts with "Error: Can not sell this token" whenever the recipient is marked, which undoes the whole transfer.
  4. A PancakeSwap sale moves the seller's tokens to the pair through transferFrom, so once the pair is marked every sale reverts. Buys, where the pair is the sender, are not checked and still succeed.
  5. The check has no owner exemption, but the owner can clear the flag, sell, and set it again. The txFee setter is cosmetic: calculateFeesBeforeSend always returns (amount, 0), so no fee is ever charged.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BEES

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.