DirtyPig Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DirtyPig (PIG) on BNB Smart Chain, contract 0x3ab81681…fbcd0c, overrides the internal _approve function so that only one hard-coded address, 0x4e512563…D624A5, can hold a non-zero allowance. For every other holder the contract stores an allowance of 0 whatever amount is approved. A DEX sale pulls tokens with transferFrom, which subtracts the amount from that allowance and reverts, while a plain transfer still works.

That address is also the deployer and the current owner(), and the owner can call mint. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-19; the code contains no function that disables transfers, so the allowance override is the control that blocks sales.

How it happened

  1. The constructor mints the whole supply, _totalSupply = 100000 * (10**10), to the deployer, with 10 decimals (100,000 tokens).
  2. _approve branches on who is approving: if (owner == address(0x4e5125634a1f8baCe0b04F9B8Fe60c5AccD624A5)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 0); }. Every other holder who approves a router or any spender ends up with an allowance of 0, although an Approval event with value 0 is emitted.
  3. transferFrom runs _transfer(sender, recipient, amount) and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). For a non-exempt sender the allowance is 0, so the sub reverts for any amount above 0 and the whole call is undone. A sale routed through transferFrom therefore fails for these holders.
  4. transfer calls _transfer directly and has no allowance check, so tokens can still move into a holder's wallet and between wallets; only spender-based pulls fail.
  5. The owner also has mint(uint256 amount) public onlyOwner, which adds to _totalSupply and to the owner's balance, and renounceOwnership/transferOwnership from Ownable. The exemption, however, is tied to the hard-coded address, not to owner().
  6. What happened: the supplied sources do not show holder losses, sale attempts or liquidity removal. De.Fi's REKT database lists the token as an Exit Scam/Honeypot on 2021-04-19.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PIG

Evidence

Same attack technique

Browse all hacks →
Ethereum Dehive.finance Loss not disclosed Ethereum Pug Token Loss not disclosed BNB Chain Nova Loss not disclosed BNB Chain Magnet Attraction Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes