Dehive.finance Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This record covers a copycat token named "Dehive.finance" (DHV) deployed on Ethereum around 19 April 2021 at 0xac5fb7b1…d65a3d, which Etherscan now tags as Fake_Phishing221308. It is not the DeHive project's own DHV token, which lives at a different address. Every transfer passes through a burnTokenCheck modifier that lets the owner, a second privileged address and owner-whitelisted addresses move tokens freely, while any other holder can only transfer amounts below a hidden _sellAmount threshold that starts at zero and that only the owner can change.

The owner can also blacklist holders through a function misleadingly named addApprove, and can mint new tokens to itself at any time. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor stores the owner argument as _owner and _safeOwner and mints the initial supply to it; the on-chain supply is 10,000,000 DHV. _owner is never reassigned and the contract has no renounce function.
  2. transfer and transferFrom both call _approveCheck, which runs the burnTokenCheck(sender, recipient, amount) modifier. The check is on sender, the holder whose tokens move.
  3. The owner's first outgoing transfer sets _safeOwner = recipient. After that, transfers from _owner or _safeOwner, or to _owner, always pass, and whitelisted senders (_whiteAddress) always pass.
  4. Every other sender reaches if (amount < _sellAmount). _sellAmount starts at 0, so no amount qualifies, and the fallback require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance") reverts a sell to the Uniswap pair with a misleading balance error.
  5. The owner sets the threshold by transferring to itself: if (sender == _owner && sender == recipient){_sellAmount = amount;}. Holders can then move only amounts below it, and a non-whitelisted holder who sends such an amount to _safeOwner is blacklisted.
  6. Owner-only functions with misleading names manage the lists: increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, and decreaseAllowance(address) replaces _safeOwner. A blacklisted sender's transfer passes only if the recipient is the router address _unirouter, so it cannot sell to the pair.
  7. _mint(address account, uint256 amount) is public but owner-only and always credits _balances[_owner], even though the Transfer event names account.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DHV

Evidence

Same attack technique

Browse all hacks →
Ethereum unifarm.co Loss not disclosed Ethereum Plethori Loss not disclosed Ethereum Pug Token Loss not disclosed BNB Chain DirtyPig Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes