DEXTrust.Finance Honeypot

What happened

The DEXTrust.Finance (DETS) token on Ethereum, contract 0x79e38991…ee5f38, only lets the owner, one owner-set trade address and owner-whitelisted addresses move tokens freely. Every other holder's transfer runs through a sale check whose limits are all zero and have no setter in the code, so the check always fails and the transfer reverts, unless the recipient is the owner. De.Fi's REKT database lists this token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor credits the whole supply to the deployer and stores it as owner: owner = msg.sender; balanceOf[msg.sender] = totalSupply;.
2. Every transfer goes through transferFrom, which calls require(ensure(_from, _to, _value)); before moving balances.
3. ensure lets a transfer pass without further checks only in these cases: if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Any other sender must satisfy require(condition(_from, _value));.
4. condition begins with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The variables _saleNum, _minSale and _maxSale are private and are never assigned anywhere in the contract, so for an ordinary holder condition always returns false and the transfer reverts. This covers a sale to a pair or router as well as a plain wallet-to-wallet transfer; only a transfer to the owner gets through.
5. The owner can exempt addresses: transferownership(addr) sets tradeAddress and approveAndCall(spender, addedValue) sets canSale[spender]=true, both restricted by require(msg.sender == owner);. Which addresses, if any, the owner exempted was not checked in a transaction.
6. approveAndCall can also overwrite a balance: if(addedValue > 0) {balanceOf[spender] = addedValue*(10**uint256(decimals));} assigns it directly without touching totalSupply.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract DETS

Evidence

• report @Token_Sniffer incident report twitter.com
• address DEXTrust.Finance (DETS) verified source on Etherscan etherscan.io
• analysis Sourcify copy of DEXTrust.sol repo.sourcify.dev