Deflagration Honeypot

What happened

Deflagration (DEF) is a BNB Smart Chain token whose transferFrom function only works for holders that appear in an allow mapping. At deployment only the deploying address is added to that mapping, and the only function that can add more addresses, addAllow, is restricted to one address hard-coded in the onlyOwner modifier. A sale through a DEX router relies on transferFrom pulling tokens from the seller, so a holder who is not on the list cannot sell that way.

De.Fi's REKT database lists the token as an exit scam/honeypot and says the owner could disable the transfer function, which restricted users from selling.

How it happened

1. The constructor sets allow[msg.sender] = true for the deployer only; every other address starts with allow[holder] == false.
2. transfer has no such check, so plain wallet-to-wallet sends and the pool paying out tokens on a purchase are not gated by it.
3. transferFrom begins with require(allow[_from] == true);, and the allowance and balance checks come before it. A router selling a holder's tokens calls transferFrom with the holder as _from, so the call reverts for any holder not on the list.
4. The list can only be edited by addAllow(address holder, bool allowApprove) external onlyOwner. The modifier is require(msg.sender == address(1080614020421183795110940285280029773222128095634));, which is the hard-coded address 0xbd486897…439192, not the owner storage variable set in the constructor. The deployer was 0xBCaC1D3E…aB01ED, a different address.
5. The same hard-coded address can also call mint(address miner, uint256 _value), which sets balances[miner] = _value without changing totalSupply.
6. The verified source shows these controls only; this draft does not establish which addresses were ever on the list, whether addAllow or mint was called, or how much value holders lost.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract DEF

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source for Deflagration (DEF) bscscan.com
• analysis Sourcify match for Deflagration (DEF) repo.sourcify.dev