DARK DEFI Honeypot

Reported loss $27K
Ethereum
Honeypot

What happened

DARK DEFI (DARK) is an Ethereum token deployed on 14 February 2021 at 0x2d98c5e9…a9850a by 0xfa5a97ce…a67b4a. Its transfer code only lets tokens move from the owner, from one owner-chosen tradeAddress, or from wallets the owner has whitelisted; every other holder's transfer and sale fails, because the sale-limit values it checks are all zero and the contract has no function to set them. The owner-only approveAndCall does not approve anything: it overwrites a chosen wallet's balance with any amount, without changing totalSupply, and whitelists that wallet to sell.

On 20 February 2021 the deployer called approveAndCall for 0x93ec7f43…bad66f in transaction 0x7d6ccdba…625b8e, and on 21 February it called it again with a much larger amount in transaction 0x32243fbb…f6fe47; about a minute later that wallet swapped 1,000 billion DARK for about 33.01 ETH on Uniswap. De.Fi's REKT database lists the loss as $26,543 and also names the initial liquidity transaction 0xc4bc0b94…4c29ea, an LP lock transaction 0x69a6c3d9…3f5693, further dumps 0x63987426…96139f and 0xddb8bc28…fa3d9c, and example transactions 0xef5c9b6d…51e76f and 0xc63eeb6f…bbfaa2.

How it happened

  1. The constructor mints the whole supply to the deployer and stores it as the private owner; the contract has no function to change or renounce owner.
  2. transferFrom (which transfer also uses) calls ensure, which passes only if _from == owner || _to == owner || _from == tradeAddress || canSale[_from]; otherwise it requires condition(_from, _value).
  3. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three values are private, default to zero and are never set anywhere, so every ordinary holder's transfer or sale reverts. Holders can only send tokens to the owner.
  4. transferownership(address addr) does not transfer ownership; it sets tradeAddress, the one extra address (such as the pair) allowed to send tokens freely, which is what lets buys go through.
  5. approveAndCall(spender, addedValue) is owner-only and runs balanceOf[spender] = addedValue*(10**uint256(decimals)) and canSale[spender]=true, so the owner can give any wallet an arbitrary balance that totalSupply does not show, and let that wallet sell.
  6. The deployer called approveAndCall for 0x93ec7f43…bad66f on 20 February 2021 (0x7d6ccdba…625b8e) and 21 February 2021 (0x32243fbb…f6fe47), and that wallet then sold 1,000 billion DARK into the Uniswap pool for about 33.01 ETH (0x3e7fb02a…03d9a6).

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DARK
Protocol links Website @dark_defi

Evidence

Same attack technique

Browse all hacks →
BNB Chain RapidSwap Loss not disclosed BNB Chain shadownite.com Loss not disclosed Ethereum Xend.finance Loss not disclosed BNB Chain Polkacomma Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes