DOGEMASK Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DOGEMASK is a BNB Smart Chain token (contract 0x544c2c5a…ad9c20). The first check inside its _transfer function is require(tx.origin == to || tx.origin == owner());, so a transfer goes through only when the transaction was started by the contract owner or when the tokens are sent to the very account that started the transaction. A sale through a DEX router pulls tokens with transferFrom(holder, pair, amount), so the recipient is the pair and not the holder, and the check reverts for every holder other than the owner.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor gives the whole supply to the deployer (_rOwned[_msgSender()] = _rTotal;, with _tTotal = 1000 * 10**6 * 10**9, which is 1,000,000,000 tokens at 9 decimals) and creates the trading pair through the hard-coded router address 0x10ED43C7…56024E.
  2. Every transfer, including transferFrom, runs through _transfer, which contains require(tx.origin == to || tx.origin == owner()); with no revert message.
  3. A buy passes the check: the pair pays out with transfer, the recipient to is the buyer, and tx.origin is the buyer's own account.
  4. A sale by any holder other than the owner reverts: the router calls transferFrom(holder, pair, amount), so to is the pair, tx.origin is the holder, and neither side of the || is true. Sending tokens to another wallet fails the same way.
  5. Only transactions started by owner() can move tokens to an arbitrary recipient. No function in the contract changes or removes the condition; the exemption simply follows owner(), which transferOwnership can reassign and renounceOwnership sets to the zero address.
  6. The owner has further levers. setTaxFeePercent and setliquidityFeePercent have no cap, and _getTValues computes tAmount.sub(tFee).sub(tLiquidity), so combined fees up to 100% of a transfer are accepted while the sender is still debited the full rAmount. setMaxTxPercent sets _maxTxAmount = _tTotal.mul(maxTxPercent).div(10**2) with no lower bound, and if(from != owner() && to != owner() && !swapAndLiquifyEnabled) require(amount <= _maxTxAmount) applies it to every transfer that does not involve the owner once setSwapAndLiquifyEnabled(false) is called.
  7. What happened is known only from the listing: De.Fi's REKT database classifies the token as an Exit Scam/Honeypot and does not give a loss figure. No transaction or holder report was opened to show the owner calling any of these functions.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DOGEMASK

Evidence

Same attack technique

Browse all hacks →
BNB Chain LordShiba Loss not disclosed Ethereum Instadapp Loss not disclosed BNB Chain Foxography Loss not disclosed BNB Chain RCums Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes