Dextrarius Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Dextrarius Token ($DXT) is a BNB Smart Chain token whose transferFrom only works when the token holder is on an owner-maintained allow list. Only the deployer is on that list at construction, so any other holder who sells through a router (which moves tokens with transferFrom) hits a revert, while plain transfer calls are not checked. De.Fi's REKT database lists the token as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so restricted users from selling.

The code reviewed does not show how many holders were affected or any amount lost.

How it happened

  1. The constructor sets allow[msg.sender] = true for the deployer only and credits the entire supply to it: balances[msg.sender] = totalSupply;.
  2. transfer has no allow-list check, so moving tokens with a direct transfer (for example a pool paying out to a buyer) is not blocked by this code.
  3. transferFrom requires require(allow[_from] == true);. Any other address defaults to false, so a router pulling a holder's tokens with transferFrom reverts.
  4. addAllow(address holder, bool allowApprove) external onlyOwner is the only way to change allow[holder], and onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)). That decimal value is 0xbd486897…439192, a hard-coded address that differs from the deployer address in the deployment record (0xffd92559…468afc), so the allow list and mint are controlled by that hard-coded address, not by the owner variable.
  5. The same address can call mint(address miner, uint256 _value), which executes balances[miner] = _value;. It overwrites a balance without changing totalSupply, so it can set any address's balance to any value.
  6. What the code allows is therefore: holders cannot sell via transferFrom unless that address adds them to allow, and it can also rewrite balances. The code does not show whether it ever did either; the sell failures are attributed only to De.Fi's REKT database listing.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract $DXT

Evidence

Same attack technique

Browse all hacks →
BNB Chain PROTOCOL PENA Loss not disclosed Ethereum Uniswap-V3 Loss not disclosed BNB Chain Yield Goku Token Loss not disclosed BNB Chain Hoe Coin BSC Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes