Dark.Build Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Dark.Build (DARK) is a BNB Smart Chain token with an owner-set sell block. The owner can mark any address with setPanCakeSwapReciever, and _transfer calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is marked. If the owner marks the DEX pool, every sale into it fails for every seller, while transfers out of the pool are not checked.

The owner can mark or unmark addresses at any time unless ownership is renounced. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-08 and describes it as an owner-controlled transfer restriction that stopped users from selling.

How it happened

  1. The constructor mints 100,000 tokens (_transferTO(msg.sender, 100000e18)) to the deployer, who is the initial owner.
  2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless) (onlyOwner), which writes PanCakeSwapReciever[_recipient] = _feeless;. The function is not gated by canWhitelist, so renounceWhitelist() does not disable it.
  3. Every transfer and transferFrom goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount). That function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer whose recipient is marked reverts and the sender's balance is restored.
  4. If the marked address is the pool, a holder's sale (a transfer from the holder to the pool, including router sales) reverts for every sender, owner included, because the check looks only at the recipient. Purchases, where the pool is the sender, are not blocked by this check.
  5. The owner can call the same function with false to unmark an address. renounceOwnership() exists, so the owner could give up the power; the code does not show whether a pool address was ever marked.

The code allows this sell block; the sources opened here do not include a transaction in which the owner marked an address or removed liquidity.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DARK

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.