Bongo Cat Honeypot

What happened

Bongo Cat (BONGO) is a BNB Smart Chain token whose transferFrom requires allow[_from] == true, a per-address flag that only the deployer receives at construction and that only a hard-coded address can grant to others. Holders can still call approve, but a router cannot pull their tokens, which is what a DEX sell needs. De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-04-11 and says the contract owner could disable the transfer function, which restricted users in selling their tokens.

The code's restriction is the allow-list on transferFrom, not a transfer switch.

How it happened

1. The constructor gives the deployer the whole supply and the only initial allow-list entry: balances[msg.sender] = totalSupply; and allow[msg.sender] = true;.
2. approve is unrestricted, so a holder can approve a router. transferFrom adds an extra gate: require(allow[_from] == true); alongside the usual balance and allowance checks. For a holder whose flag is false, a router's transferFrom(holder, pair, amount) reverts, so a sell through a router fails.
3. transfer has no allow-list check (require(balances[msg.sender] >= _value); only), so direct transfers, including a pool sending tokens to a buyer, are not blocked by the code.
4. The flag can be changed only through addAllow(address holder, bool allowApprove) external onlyOwner. The modifier is modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}, a literal address that equals 0xbd486897…439192. The owner storage variable is set to the deployer in the constructor but no access check reads it, and the deployment record shows a different deployer (0xAe7DF797…7C935B).
5. The same hard-coded address can also call mint(address miner, uint256 _value), which executes balances[miner] = _value;. That overwrites a balance without changing totalSupply, so it can set any holder's balance, including to zero. The code allows this; no transaction was opened showing it being used.
6. The source header says "ownership renounced" and "LP locked forever". The contract has no renounce function and no liquidity-lock code, so those lines are comments, not enforced behavior.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract BONGO

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, Bongo Cat (BONGO) bscscan.com
• analysis Sourcify match, chain 56, 0x47f1827262e23c2eb24943a684ff6493e07f064d repo.sourcify.dev