What happened
Bichon (BICHON) is a BEP-20 token on BNB Smart Chain whose transferFrom reverts unless the token holder is on an allow list that initially contains only the deployer. DEX sells move tokens with transferFrom, so ordinary holders cannot sell, while buys, which the pair pays out with transfer, are not checked. A privileged address hard-coded in the onlyOwner modifier can add holders to the list and overwrite any balance with mint.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot and describes it as a contract where the owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor puts the whole supply on the deployer and whitelists that address only:
balances[msg.sender] = totalSupply;andallow[msg.sender] = true;. The on-chain supply read is 10^33 raw units with 18 decimals, which is 10^15 tokens. transferFromcarries an extra condition thattransferlacks:require(allow[_from] == true);. The_fromof a sell through a router is the seller, who is not inallow, so the call reverts.transferhas no such check (require(balances[msg.sender] >= _value);only), so wallet-to-wallet transfers and the pair's payout to a buyer work. A buy therefore succeeds while a sell does not.- The owner-only functions use a modifier whose address is written into the code:
modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That decimal equals 0xbd486897…439192. The contract'sownervariable is set frommsg.senderat deployment but is not used by this modifier, and it differs from the deployer address in the deployment record. - That privileged address can call
addAllow(address holder, bool allowApprove)to switch theallowflag for any holder, so it can open or close selling for individual addresses. It can also callmint(address miner, uint256 _value), which executesbalances[miner] = _value;. This overwrites the balance of any address, including a liquidity pair, without changingtotalSupplyor emitting an event. - The header comment advertises 3% reflection, 1% auto liquidity, 1% burn and liquidity locked 100% for 365 days, but the code has no fee, reflection, burn or lock logic.
- What happened: De.Fi's REKT database lists this token as an Exit Scam/Honeypot dated 2021-09-14 with no loss figure. No opened transaction or holder page in this review shows an
addAllowormintcall, a failed sell, or a liquidity removal.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
