DoubtFire Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists DOUBTFIRE on BNB Smart Chain as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The source code shows how: the owner-only setMaxTxPercent has no lower bound, so the per-transaction cap can be set to zero, and the cap is enforced on every transfer where neither side is the owner. The owner can also set the two fee percentages to any value with no cap.

The code allows this; it does not show whether the owner ever called these functions.

How it happened

  1. The token is a reflection-fee token with 9 decimals and a supply of 1000000000 * 10**6 * 10**9 raw units. The constructor creates the pair uniswapV2Pair and gives the whole supply to the deployer, who is also the Ownable owner.
  2. _transfer enforces a cap on every transfer unless the sender or the recipient is the owner: if(from != owner() && to != owner()) require(amount <= _maxTxAmount, "Transfer amount exceeds the maxTxAmount.");. It also requires amount > 0.
  3. _maxTxAmount starts at 0.5% of supply, but setMaxTxPercent(uint256 maxTxPercent) (onlyOwner) sets it with _maxTxAmount = _tTotal.mul(maxTxPercent).div(10**2); and accepts 0. At 0, every transfer by an ordinary holder, including a sell to the pair or a buy from it, reverts, while transfers to or from the owner still pass.
  4. The fee setters setTaxFeePercent and setLiquidityFeePercent also take any value. Fees are deducted in _getTValues as tAmount.sub(tFee).sub(tLiquidity). If the two percentages add up to 100, the recipient is credited zero while the seller's _rOwned is still debited the full amount; above 100 the subtraction reverts. The owner and the token contract are fee-exempt from construction (_isExcludedFromFee[owner()] = true;).
  5. addLiquidity sends the LP tokens it mints to owner(). Ownable also contains renounceOwnership and lock, so the owner could give these powers up; the code alone does not show whether that happened.
  6. What happened: De.Fi's REKT database lists the token as a honeypot with the owner able to disable transfers. No transaction was opened, so the code evidence does not show when or whether the cap or the fees were changed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DOUBTFIRE
Protocol links Website @DoubtfireBSC

Evidence

Same attack technique

Browse all hacks →
BNB Chain WeSpace Loss not disclosed BNB Chain NoCapCoin Loss not disclosed BNB Chain ElonGate Loss not disclosed BNB Chain PIDGEY Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes