Comet Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists COMET as an exit scam/honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified BEP20 source (contract 0xfe7a1179…00595e) has no transfer switch. Instead its internal _approve keeps allowances only for one hard-coded address, 0x2b337c2E…707baE, which is the deployer.

For every other address _approve stores an allowance of 0, so any transferFrom for a positive amount reverts and swaps that pull tokens through an allowance cannot complete. Plain transfer calls do not touch allowances. The code shows what the design allows; no opened transaction or source in this review shows how many holders were affected or what was lost.

How it happened

  1. The constructor sets _totalSupply = 4800000000000000; (6 decimals, so 4.8 billion tokens) and credits all of it to the deployer with _balances[msg.sender] = _totalSupply;.
  2. approve calls _approve(_msgSender(), spender, amount). Inside _approve, only the hard-coded address passes if (owner == address(0x2b337c2E43666B76bFC8a3543FE209a227707baE)) and gets the real allowance stored.
  3. Every other holder takes the else branch: _allowances[owner][spender] = 0; followed by emit Approval(owner, spender, 2);. The event reports a value of 2 while the stored allowance stays 0.
  4. transferFrom runs _transfer(sender, recipient, amount) and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). With a stored allowance of 0, the sub reverts for any positive amount and the whole call, including the balance move, is rolled back.
  5. Because a swap back to the base asset normally pulls tokens from the holder through an allowance, the gate means only the hard-coded address can use that path; plain transfer still works for everyone.
  6. The gate checks a hard-coded address, not _owner, so renounceOwnership() would not remove it. The owner also has mint(uint256 amount) with no cap, which the owner can call.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract COMET

Evidence

Same attack technique

Browse all hacks →
BNB Chain Nova Loss not disclosed BNB Chain Magnet Attraction Loss not disclosed Ethereum Coordinape Loss not disclosed BNB Chain FireBunny Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes