Bombic Finance Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Bombic Finance (BMB) is an Ethereum token whose transferFrom routes every move through an ensure check that rejects almost every sender. Only the owner, the address stored in tradeAddress, and accounts the owner marked in canSale pass. Everyone else reaches condition(), which returns false while _saleNum, _minSale and _maxSale are all zero, and no function in the contract can change those three values, so their transfers revert.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-03, describing a contract whose owner could disable the transfer function, which restricted users in selling their tokens. The code shows the restriction; the listing's proof post could not be opened, so how holders were affected is not established here.

How it happened

  1. The constructor sets owner = msg.sender; and gives the deployer the full supply (balanceOf[msg.sender] = totalSupply;).
  2. transfer calls transferFrom(msg.sender, _to, _value), and transferFrom runs require(ensure(_from, _to, _value)); before it debits balanceOf[_from].
  3. ensure returns true early only for privileged cases: if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. A holder moving tokens to any address other than owner falls through to require(condition(_from, _value));.
  4. condition begins with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three variables are declared private and the source never assigns them, so the condition stays false and the require reverts for every non-privileged sender.
  5. The owner controls who is exempt. approveAndCall(address spender, uint256 addedValue) is owner-only and sets canSale[spender]=true;. transferownership(address addr), despite its name, only sets tradeAddress = addr;. The same approveAndCall also overwrites the spender's balance with balanceOf[spender] = addedValue*(10**uint256(decimals)); without touching totalSupply, when addedValue is above zero.
  6. Sending tokens to the owner address is allowed (_to == owner), so a holder can return tokens to the owner but cannot sell them to another address unless the owner has exempted them.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BMB

Evidence

Same attack technique

Browse all hacks →
Ethereum Palm.io Loss not disclosed BNB Chain EXODUS Loss not disclosed BNB Chain CUATROtoken Loss not disclosed Ethereum Xcademy Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes