Dopex Governance Token Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Dopex Governance Token (DOPEX) is an Ethereum token deployed on 11 April 2021 at 0xa2b5c6d8…85ec0f. Every transfer and transferFrom runs through a burnTokenCheck modifier that only lets tokens move freely when the owner, a second owner-set address called _safeOwner, or an owner whitelist is involved. Any other holder's transfer, including a sale into the Uniswap pair, reverts with a fake "transfer amount exceeds balance" error unless it is below an owner-set _sellAmount threshold that starts at zero, and a transfer below that threshold sent to the _safeOwner address puts the sender on a blacklist.

The owner can also mint without limit, and its mint function credits the owner's balance while emitting Transfer events that show tokens going to other addresses. De.Fi's REKT database lists DOPEX as an exit scam/honeypot, stating that holders were restricted from selling.

How it happened

  1. The constructor sets _owner and _safeOwner to a constructor-supplied address and calls _mint 20 times. _mint requires msg.sender == _owner, so the owner must be the deployer, and each call adds to _balances[_owner] while emitting Transfer(address(0), account, amount) for five other addresses.
  2. The owner's first outgoing transfer (while _owner == _safeOwner) sets _safeOwner to that recipient, and the owner can later change it with the misnamed decreaseAllowance(address safeOwner).
  3. burnTokenCheck lets a transfer through if the sender is _owner or _safeOwner, the recipient is _owner, or the sender is whitelisted. A blacklisted sender can only send to _unirouter.
  4. For every other sender, the transfer passes only if amount < _sellAmount; otherwise it hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). A router sale sends tokens to the pair, not the router, so it reverts. _sellAmount is 0 until the owner sends tokens to itself, which sets it to that amount.
  5. If a holder's transfer below _sellAmount goes to _safeOwner, the modifier sets _blackAddress[sender] = true, so later sales fail.
  6. The owner manages the lists with the misnamed increaseAllowance(address[]) (whitelist) and addApprove(address[]) (blacklist), and multiTransfer sends tokens while whitelisting recipients and approving the Uniswap router for them. The public _mint lets the owner add any amount to its own balance.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DOPEX

Evidence

Same attack technique

Browse all hacks →
BNB Chain Enceladus Loss not disclosed Ethereum Polkasol Loss not disclosed BNB Chain SAFEMOUSE Loss not disclosed BNB Chain FairSafeApe Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes