Dragon.Swap Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Dragon.Swap is a BEP-20 token deployed on BNB Chain on 6 May 2021 at 0xeda01f23…7349d0. Its _approve function stores a real allowance only when the approving wallet is the hard-coded deployer address 0xB625ca69…26db70; for every other holder it silently writes an allowance of zero. A DEX sale pulls tokens with transferFrom, which needs an allowance, so buyers could acquire the token but not sell it through a router, while the deployer could.

The trap is written into the code, not switched on by the owner, so the owner being renounced (the on-chain owner is now the zero address) does not remove it. De.Fi's REKT database lists Dragon.Swap as an exit scam/honeypot dated 6 May 2021, with no loss figure.

How it happened

  1. The constructor mints the whole supply of 6,458,200 tokens (9 decimals) to the deployer, 0xB625ca69…26db70.
  2. _approve checks if (owner == address(0xB625ca690e3fC4645A36437249f92BD65526db70)) and only then stores the requested amount. For anyone else it sets _allowances[owner][spender] = 0 and still emits an Approval event, so an approval transaction succeeds but grants nothing.
  3. Buying works, because the pool sends tokens with a plain transfer, which has no allowance check.
  4. Selling through a router calls transferFrom, which moves the tokens and then subtracts the amount from the caller's allowance with sub(amount, "BEP20: transfer amount exceeds allowance"). With an allowance of zero this reverts, so the whole sale fails for every holder except the deployer.
  5. The deployer's approvals are stored normally, so that address can sell into the pool. The owner also has an uncapped mint(uint256), but the current total supply equals the constructor amount, and with the owner now the zero address it can no longer be called.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Dragon.Swap

Evidence

Same attack technique

Browse all hacks →
Ethereum Ispolink Token Loss not disclosed BNB Chain TheCatToken.com Loss not disclosed BNB Chain dogemars Loss not disclosed BNB Chain DEFIX Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes