DAOstreetbets Honeypot

Reported loss $548
BNB Chain
Honeypot

What happened

DAOstreetbets (DAOsb) was a BEP20 token on BNB Smart Chain created with 99 tokens minted to the deployer. Its transfer path contains an owner-controlled list called PanCakeSwapReciever: any transfer whose recipient is on that list reverts with Error: Can not sell this token. Because a sale on PancakeSwap sends tokens to the pair contract, the owner can list the pair address and stop every holder from selling, while buys and transfers to other addresses keep working.

De.Fi's REKT database lists the incident as an exit scam / honeypot with a 548 USD loss, and describes the deployer adding liquidity and later removing it; those transactions could not be opened for this review.

How it happened

  1. The constructor mints the entire supply to the deployer: _transferTO(msg.sender, 99e18);. The deployer is also the Ownable owner, and owner() still reads as that address on-chain.
  2. The owner can mark any address as a blocked recipient: function setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner { ... PanCakeSwapReciever[_recipient] = _feeless; }. Unlike the whitelist setters, this one is not limited by canWhitelist, so renounceWhitelist() does not switch it off.
  3. Every transfer runs calculateFeesBeforeSend(sender, recipient, amount) after the sender's balance has been reduced, and that function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }; otherwise it returns (amount, 0). The check is on the recipient, so it stops tokens from reaching a listed address regardless of who sends them.
  4. A sale on PancakeSwap moves tokens from the seller to the pair (via the router's transferFrom), so if the owner sets PanCakeSwapReciever to true for the pair address, every sale reverts. Buys, where the pair is the sender, and transfers to unlisted wallets are unaffected, and the owner can set the flag back to false at any time.
  5. The txFee and feeDistributor variables are not used in the transfer math, because calculateFeesBeforeSend always returns (amount, 0), so the contract takes no fee; the blocked-recipient check is the only control that stops sales.
  6. This describes what the code allows. De.Fi's REKT database lists the deployer as adding liquidity in tx 0xcc5d2a04…2129f3 and removing it in tx 0x81f380ef…3d31f3; BscScan returned HTTP 403, so neither transaction, nor any call to setPanCakeSwapReciever, was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DAOsb

Evidence

Same attack technique

Browse all hacks →
BNB Chain AK47 Loss not disclosed BNB Chain Alchemist Loss not disclosed Ethereum Kylin Network Loss not disclosed BNB Chain Slime.Finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes