CHINESE Honeypot
What happened
CHINESE (CHINESE) overrides transferFrom with a gate: require (trans || moi == sender || moi == recipient || sender == UNI);. The flag trans is set to false in the constructor, and only an account holding MINTER_ROLE can change it with setTrans, so while it is false any transferFrom between ordinary holders, including a sale pulled into the pair by a router, reverts. De.Fi's REKT database lists the token as an Exit Scam/Honeypot on BNB Smart Chain and says the contract owner could disable the transfer function, which restricted users in selling their tokens.
The contract also exposes public renounceOwnership() and lockLiquidity() functions that only emit events. No transaction hash, attacker address or loss figure is available for this record.
How it happened
What the code allows:
- The constructor stores the deployer as the private immutable
moi, setstrans = false, grants the deployerDEFAULT_ADMIN_ROLE,PAUSER_ROLEandMINTER_ROLE, and mints1000000000000 * 10 ** decimals()tokens to it. transferFromis overridden:address UNI = uniswapV2Pair; require (trans || moi == sender || moi == recipient || sender == UNI);and then runs_transfer. Whiletransisfalse, atransferFrompasses only if the deployer is the sender or recipient, or the pair is the sender. A holder-to-pairtransferFrom, which is how a router moves tokens into a pair on a sale, matches none of these and reverts without an error message.setTrans(bool value)requireshasRole(MINTER_ROLE, msg.sender), so only aMINTER_ROLEaccount can change the gate; the source does not show whether it was ever called.transferis not overridden, so directtransfercalls are not subject to this gate.pause()andunpause()needPAUSER_ROLE, and_beforeTokenTransferiswhenNotPaused, so a pauser can freeze every transfer.piocher(address to, uint256 amount)mints to any address for aMINTER_ROLEaccount.- The functions that look like safeguards do nothing:
function renounceOwnership() public { emit OwnershipRenounced(address(0), address(this)); }andfunction lockLiquidity() public { emit liquidityLocked(uniswapV2Pair, address(0)); }have no access check and change no state, and calling them only emits an event.
De.Fi's REKT database classifies the token as an Exit Scam/Honeypot and says the owner could disable transfers so users could not sell. The source alone does not show the current value of trans, any call to setTrans, pause or piocher, or any failed sale, so no transaction is cited.
Protocol details
Evidence
- report Sourcify match source for 0xeb1dcc9b569bc2cd1ff223e984abaacb13638dd5 (Chinese.sol) repo.sourcify.dev
- address BscScan verified source: Chinese 0xeb1dcc9b569bc2cd1ff223e984abaacb13638dd5 bscscan.com
- analysis De.Fi REKT database listing, proof link (Token Sniffer exploit page; HTTP 403) tokensniffer.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.