Eclipse Honeypot

What happened

Eclipse (ECLIPSE) is a BNB Smart Chain token at 0xe50b465a…e0cb04 whose _approve function only honours approvals from one hard-coded address, 0x70f2fC92…20dD4F, which is also the deployer and current owner. For every other holder the allowance is stored as 0, so a DEX router cannot pull their tokens with transferFrom and a sell reverts, while buying and plain wallet-to-wallet transfers still work. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply;.
2. approve calls _approve(_msgSender(), spender, amount), and _approve branches on the hard-coded address: if (owner == address(0x70f2fC9204a2320B3C75CE43B2343EAFd720dD4F)) { the amount is stored; } else { the code runs _allowances[owner][spender] = 0; and emits Approval(owner, spender, 0). A holder's approve call therefore succeeds without reverting but records nothing.
3. A DEX sell needs the router to call transferFrom(holder, pair, amount). That function runs _transfer and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). The stored allowance is 0, so sub reverts for any amount above 0 and the whole call, including the transfer, is undone.
4. Buys are unaffected: the pair sends tokens with a plain transfer, which only runs _transfer. The hard-coded address passes step 2, so its own approvals work.
5. The exemption is tied to the address, not to owner(), so renounceOwnership or transferOwnership would not remove it. Separately, mint(uint256 amount) is onlyOwner and credits the owner, so the owner can also create new supply.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ECLIPSE

Evidence

• address BscScan verified source, Eclipse bscscan.com
• analysis Scam explained: BSC noapproval cryptot3ddybear.gitlab.io
• analysis Sourcify match, chain 56, 0xe50b465ae2356cae271c464fa440e06dd8e0cb04 repo.sourcify.dev
• analysis De.Fi REKT database listing for ECLIPSE (imported listing fields in meta.json) de.fi