DRACULA PROJECT Honeypot
What happened
DRACULA PROJECT (DRACULA) is a BNB Chain token deployed on 12 April 2021 at 0xec4949a8…e53bd7. Its internal _approve function stores the requested allowance only when the token owner is the hard-coded deployer address 0x9a9E9a6b…06e452; for every other holder it writes an allowance of zero. A PancakeSwap sale needs the router to move the holder's tokens with transferFrom, which subtracts the amount from that zero allowance and reverts, so ordinary holders cannot sell through the router while buys from the pair still work.
The owner can also mint any amount of new tokens to itself. De.Fi's REKT database lists DRACULA as an exit scam/honeypot, stating that holders were restricted from selling their tokens.
How it happened
- The constructor mints the full 50,000,000 DRACULA supply (
5000000000with 2 decimals) to the deployer, who also becomes theOwnableowner. - When any holder calls
approveorincreaseAllowance,_approvechecksowner == address(0x9a9E9a6bA9413Ae3E2a64dA41d84eb45FE06e452); for everyone else it sets the allowance to0and emitsApproval(owner, spender, 0). - A router sale calls
transferFrom(holder, pair, amount). The function moves the tokens, then computes_allowances[sender][_msgSender()].sub(amount, ...)on a zero allowance, which reverts the whole transaction. - Buys use the pair's plain
transferto the buyer, which has no allowance step, so purchases go through and the deployer's own address can still approve and sell. mint(uint256 amount)isonlyOwnerand adds any amount to the caller's balance and to total supply.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report De.Fi REKT database listing for DRACULA (proof link: Token Sniffer X post 1380219360631906307) twitter.com
- transaction DRACULA PROJECT contract creation transaction bscscan.com
- address DRACULA PROJECT verified contract code on BscScan bscscan.com
- analysis Sourcify match for 0xec4949a82cd52e1ac1124cd5f7d58d3f8ee53bd7 on BNB Chain repo.sourcify.dev
- analysis BSC-SCAM: PancakeSwap NoApproval (Blockchain Security Stories, cryptot3ddybear, 2021-04-08) cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.