BSCView Honeypot

What happened

De.Fi's REKT database lists BSCView (BSCV) on BNB Smart Chain as an exit scam / honeypot. The verified source has no single switch that turns transfers off. Every transfer and transferFrom runs through a burnTokenCheck modifier that, for an ordinary holder, only lets tokens move to the router address 0x05fF2B0DB69458A0750badebc4f9e13aDd608C7F or to the owner.

A sale routed through a liquidity pair sends tokens to the pair address, so the check can revert it. The owner alone can whitelist addresses, blacklist addresses and set the _sellAmount threshold that changes who the check lets through.

How it happened

1. Every transfer and transferFrom calls _approveCheck, which carries the modifier burnTokenCheck(sender,recipient,amount), so the checks below apply to all token movements.
2. Privileged paths pass: the first transfer sent by the owner while _owner == _safeOwner runs _safeOwner = recipient, and any transfer where sender == _owner || sender == _safeOwner || recipient == _owner passes. A whitelisted sender (_whiteAddress[sender] == true) also passes.
3. A sender that is neither privileged nor whitelisted reaches if (amount < _sellAmount). _sellAmount starts at 0, so no amount is below it and the code runs require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). A transfer from such a holder to any address other than _unirouter or _owner, including a pair address, reverts. A blacklisted sender (_blackAddress[sender] == true) faces the same require.
4. The owner controls who is in which group: increaseAllowance(address[]) whitelists and un-blacklists, addApprove(address[]) blacklists and un-whitelists, and multiTransfer can whitelist recipients and give the router a maximum allowance over them. decreaseAllowance(address) repoints _safeOwner.
5. The owner can also set the threshold: a transfer where sender == _owner && sender == recipient runs _sellAmount = amount. Once it is set, an ordinary sender with amount < _sellAmount passes, and if recipient == _safeOwner that sender is blacklisted by _blackAddress[sender] = true.
6. _mint(address,uint256) is public and restricted to _owner; it raises _totalSupply and credits _balances[_owner], whatever account is passed. The contract has no ownership transfer or renounce function.
7. What the code allows is separate from what happened: De.Fi's REKT database lists the token as a honeypot with its Token Sniffer proof post, but no transaction showing which of these functions were called was opened.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract BSCV

Evidence

• report De.Fi REKT database entry for BSCV (proof: Token Sniffer post, not retrievable) twitter.com
• address BSCView verified source on BscScan (0xb5c127966eac1ca293b538ae2331d1057d894059) bscscan.com
• analysis Sourcify match for BSCView repo.sourcify.dev