COPE Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

COPE is an ERC-20 token deployed on Ethereum on 29 March 2021 at 0xfa19cee6…13a1c5 by 0xC2CE6a83…38732F. Every transfer passes through a modifier, burnTokenCheck, that lets the owner, a second privileged address _safeOwner and owner-whitelisted wallets move tokens freely. For any other holder, a sale to the pool fails with the misleading error "ERC20: transfer amount exceeds balance" unless it is smaller than an owner-set threshold, and even then the seller is blacklisted after that one sale.

The whitelist, blacklist and _safeOwner controls hide behind standard-looking names: increaseAllowance, addApprove and decreaseAllowance. De.Fi's REKT database lists COPE as an exit scam/honeypot dated 29 March 2021, with no loss figure.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument. Because _mint requires msg.sender == _owner, deployment only succeeds if that argument is the deployer. _mint credits _balances[_owner] but emits Transfer(address(0), account, amount), so the ten constructor mints look like transfers to other addresses while every token is credited to the owner.
  2. In burnTokenCheck, if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;} makes the recipient of the owner's first outgoing transfer the _safeOwner. If that transfer is the liquidity deposit, the pool becomes _safeOwner, so the pool's transfers to buyers always pass.
  3. A holder who is not the owner, _safeOwner or whitelisted can transfer only if amount < _sellAmount, and a transfer to _safeOwner then sets _blackAddress[sender] = true. Any larger transfer, and any transfer by a blacklisted address, must satisfy require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"), which a sale into the pool does not.
  4. _sellAmount starts at zero, so every sale fails until the owner sets it with a transfer to itself (if (sender == _owner && sender == recipient){_sellAmount = amount;}).
  5. Owner-only functions change who is exempt: increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, decreaseAllowance(address) replaces _safeOwner, and multiTransfer sends tokens and whitelists the first recipients. _mint is public but owner-only, has no cap and credits the owner. The contract has no function that changes _owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract COPE

Evidence

Same attack technique

Browse all hacks →
BNB Chain ZirgonYield Loss not disclosed BNB Chain WhiteX Finance Loss not disclosed BNB Chain NEOBUX Loss not disclosed BNB Chain MoonFEG Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes