EasyFinance Honeypot

What happened

EasyFinance is a BEP-20 token whose transfer logic contains an owner-controlled sell block. calculateFeesBeforeSend reverts with "Error: Can not sell this token" whenever the recipient is flagged in PanCakeSwapReciever, and the owner alone can set that flag for any address with setPanCakeSwapReciever. De.Fi's REKT database lists the token as an exit scam/honeypot in which the contract owner could disable the transfer function and restrict users from selling.

How it happened

1. The constructor mints 50,000 tokens to the deployer: _transferTO(msg.sender, 50000e18);.
2. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and writes PanCakeSwapReciever[_recipient] = _feeless;. It has no canWhitelist check, so renounceWhitelist() does not disable it, and it has no limit on which address can be flagged.
3. Every transfer and transferFrom goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount). That function runs if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, undoing the whole transfer including the sender's balance debit.
4. If the owner flags a trading pair as a recipient, any sale that sends tokens to that pair reverts for every sender, including the owner. Buys, where the pair is the sender, are not affected by this check. The code does not show which addresses were flagged.
5. The fee code is inert: calculateFeesBeforeSend returns (amount, 0), so txFee is never applied.
6. The owner can give the power up with renounceOwnership(); the code does not show whether it was called. What happened: only De.Fi's REKT database listing supports the honeypot classification; its proof tweet could not be opened.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract EASYF

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, EasyFinance bscscan.com
• analysis Sourcify match, chain 56 repo.sourcify.dev