CaliSwap Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

CaliSwap (CALI) is a BNB Chain token deployed on 28 February 2021 at 0xeef3d08a…09c6f1, with its full 4,500,000 CALI supply minted to the deployer. Every transfer runs through calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping, and only the owner can set that flag through setPanCakeSwapReciever. If the PancakeSwap pair is flagged, any transfer into the pair, which is how a sale works, fails, while purchases paid out by the pair to buyers still succeed.

Unlike the fee whitelist, this flag is not frozen by renounceWhitelist, so it stays under owner control until ownership is renounced. De.Fi's REKT database lists CaliSwap as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor mints 4,500,000 CALI to the deployer through _transferTO, which also makes the deployer the feeDistributor; the deployer is the Ownable owner.
  2. The owner can call setPanCakeSwapReciever(address, true) for any address, including the PancakeSwap pair. The function has no canWhitelist check, so renounceWhitelist does not lock it.
  3. _transfer calls calculateFeesBeforeSend(sender, recipient, amount) on every transfer and transferFrom. That function reverts with "Error: Can not sell this token" when PanCakeSwapReciever[recipient] is true.
  4. A sale sends tokens from the holder to the pair, so once the pair is flagged every sale reverts. A purchase sends tokens from the pair to the buyer, whose address is not flagged, so buying keeps working.
  5. The owner can clear the flag at any time with setPanCakeSwapReciever(pair, false), so the owner alone decides when the pair accepts tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract CALI

Evidence

Same attack technique

Browse all hacks →
BNB Chain ZELDASWAP Loss not disclosed BNB Chain Raydium Protocol Loss not disclosed BNB Chain PROJECTX Loss not disclosed BNB Chain SexySwap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes