DOORToken Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DOORToken is a BEP20 token whose _transfer function reverts for almost every sender while a private flag called TIME is true, and TIME is true from deployment. The only senders and recipients that pass are the owner and the address stored in pancake; an ordinary holder sending tokens to a pool or to another wallet hits a revert whose message promises a 30-minute sale limit although the code compares no time. The owner can lift the block with setTIME(false) and can re-point pancake, cap sell size or flag senders as bots.

De.Fi's REKT database lists DOOR on BNB Smart Chain as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. No transaction was opened to show which of these functions the owner called.

How it happened

  1. The constructor mints the full supply to the deployer: _mint(msg.sender, 1000000000000000e18);, which is 10^15 tokens.
  2. bool private TIME = true; is on from deployment, and setTIME(bool _bool) public onlyOwner is the only function that changes it.
  3. Inside _transfer, this line runs for every transfer: if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. The branch has no timestamp comparison. transData is written by saveTransData but nothing in the contract reads it, so the message describes a limit the code does not implement.
  4. A holder who is neither the owner nor pancake therefore reverts on any transfer to any recipient other than the owner, including a sale into a liquidity pool. Whether a buy passes depends on pancake: a buy sends tokens from the pool, so it passes only when the pool address is the stored pancake.
  5. pancake moves under owner control. if(sender == owner()){ pancake = recipient; } rewrites it on every transfer the owner sends, and addPancake(address input) public onlyOwner sets it directly.
  6. The owner has further levers. fire(uint256 TKP) sets the cap MAX (default 10000e18) that applies when the recipient is flagged by POOL(address,bool), so larger sales revert with "Syntax Error. Please Re-Submit Order". GTYA(address,bool) flags a sender as a bot, and if(bot[sender] == true){ require(amount <=0, "bots......"); } then reverts every transfer from it, since an earlier check already requires amount > 1000. setFee accepts up to 100, and the fee is amount.mul(txFee).div(1000), which is 10% of the amount, not the 1% the code comment states; it starts at 0.
  7. Ownership has not been renounced in the read taken on 2026-09-30: owner() returns 0x3a6f8a35…edbb78, the deployer.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DOOR

Evidence

Same attack technique

Browse all hacks →
BNB Chain KNIGHT RIDER Loss not disclosed BNB Chain HungryWorldBSC Loss not disclosed BNB Chain Lucky Token Loss not disclosed BNB Chain SolarRocket Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes