EchoX Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists EchoX (ECHO) on BNB Smart Chain as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The code has no transfer switch. It has an owner-only setFeeEnabled toggle that, once on, charges a fee on every transfer into the liquidity pair that rounds to the full amount.

A holder's balance is debited in full while the pair receives only the remainder below 100 raw units, so a sell cannot deliver its tokens. The code allows this; it does not show whether the owner turned the fee on.

How it happened

  1. The constructor sets _owner = msg.sender;, gives the owner the whole supply of 100000000 * 10**9 raw units (9 decimals), and creates the pair uniswapV2Pair through the hard-coded router 0x10ED43C718714eb63d5aA57B78B54704E256024E.
  2. _feeEnabled starts as false. setFeeEnabled(bool feeEnabled) checks require(_owner == msg.sender); and can switch it on or off at any time. The contract has no function that changes or renounces _owner.
  3. _transfer first debits the sender: _balances[from] = sub(_balances[from], amount);. If the fee is on, the recipient is the pair, and the sender is not the router, the owner or the token itself, it takes the fee branch.
  4. The fee is computed as uint256 fee = mul(div(amount, 100), 100);. Dividing by 100 and multiplying by 100 returns the amount rounded down to a multiple of 100, which is almost the entire amount, not 1%. The pair is credited only sub(amount, fee), which is amount modulo 100 raw units, and the fee is removed from _totalSupply.
  5. The owner is exempt (from != _owner), so the owner's own transfers to the pair keep the full amount while a holder's do not. Purchases from the pair are not affected because the fee condition looks only at transfers to the pair.
  6. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. No transaction was opened, so the code evidence does not show when, or whether, setFeeEnabled(true) was called, nor any loss figure.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ECHO

Evidence

Same attack technique

Browse all hacks →
Ethereum SafeShib Loss not disclosed BNB Chain ChickenCoin Loss not disclosed BNB Chain Strike Protocol Loss not disclosed BNB Chain SafeCookie Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes