BULLRUN Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

BULLRUN is a BNB Smart Chain token that overrides transferFrom so that, while the trans flag is false, only transfers sent by the deployer, to the deployer, or from the PancakeSwap-style pair created in the constructor are allowed. A holder selling through a router calls transferFrom with themselves as sender, so the sale reverts until an account with MINTER_ROLE calls setTrans(true). The same role can mint without a cap, and the functions renounceOwnership and lockLiquidity only emit events.

De.Fi's REKT database lists BULLRUN as an Exit Scam/Honeypot dated 2021-05-24; no loss figure is given.

How it happened

  1. The constructor starts with sells closed and gives the deployer every role: trans = false;, _setupRole(MINTER_ROLE, msg.sender);, and mints 1000000000000 * 10 ** decimals() to the deployer. It also creates the token's pair with the router's createPair and stores it as uniswapV2Pair.
  2. transferFrom is overridden with a gate: require (trans || moi == sender || moi == recipient || sender == UNI); where moi is the deployer and UNI is the pair.
  3. A router sale calls transferFrom(holder, pair, amount). With trans false, the holder is not moi, the recipient is the pair rather than moi, and the sender is not the pair, so the require reverts. A buy moves tokens from the pair (sender == UNI), so it passes.
  4. setTrans(bool value) is gated by hasRole(MINTER_ROLE, msg.sender), so the role holder alone decides whether ordinary holders can sell. The plain transfer function is not overridden, so a direct wallet-to-wallet transfer is not covered by this gate; only the transferFrom path used by routers is.
  5. Other powers in the same contract: pause() / unpause() (PAUSER_ROLE) stop all transfers through _beforeTokenTransfer ... whenNotPaused, and piocher(address to, uint256 amount) lets a MINTER_ROLE holder mint any amount.
  6. renounceOwnership() only runs emit OwnershipRenounced(address(0), address(this)); and lockLiquidity() only runs emit liquidityLocked(uniswapV2Pair, address(0));; neither changes any role or state.
  7. What the code allows is the above. What happened is only that De.Fi's REKT database lists BULLRUN as a honeypot; no transaction was opened showing setTrans, minting, a failed sale or a loss.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BULLRUN

Evidence

Same attack technique

Browse all hacks →
BNB Chain GO Loss not disclosed BNB Chain COFFEE MOON Loss not disclosed BNB Chain OnlyFans Loss not disclosed BNB Chain Redbean Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes