DRACULA PROJECT Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DRACULA PROJECT (DRACULA) is a BNB Chain token deployed on 12 April 2021 at 0xec4949a8…e53bd7. Its internal _approve function stores the requested allowance only when the token owner is the hard-coded deployer address 0x9a9E9a6b…06e452; for every other holder it writes an allowance of zero. A PancakeSwap sale needs the router to move the holder's tokens with transferFrom, which subtracts the amount from that zero allowance and reverts, so ordinary holders cannot sell through the router while buys from the pair still work.

The owner can also mint any amount of new tokens to itself. De.Fi's REKT database lists DRACULA as an exit scam/honeypot, stating that holders were restricted from selling their tokens.

How it happened

  1. The constructor mints the full 50,000,000 DRACULA supply (5000000000 with 2 decimals) to the deployer, who also becomes the Ownable owner.
  2. When any holder calls approve or increaseAllowance, _approve checks owner == address(0x9a9E9a6bA9413Ae3E2a64dA41d84eb45FE06e452); for everyone else it sets the allowance to 0 and emits Approval(owner, spender, 0).
  3. A router sale calls transferFrom(holder, pair, amount). The function moves the tokens, then computes _allowances[sender][_msgSender()].sub(amount, ...) on a zero allowance, which reverts the whole transaction.
  4. Buys use the pair's plain transfer to the buyer, which has no allowance step, so purchases go through and the deployer's own address can still approve and sell.
  5. mint(uint256 amount) is onlyOwner and adds any amount to the caller's balance and to total supply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DRACULA

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.