ECOMI Honeypot

What happened

This OMI token on BNB Smart Chain gates transferFrom behind a per-address allow flag that only the deployer holds at creation. Any holder who is not on the list has every transferFrom revert, which is the call a DEX router makes when selling, while plain transfer stays open. The onlyOwner modifier compares the caller to a hard-coded address instead of the stored owner, and that address controls addAllow and mint.

De.Fi's REKT database lists the token as an exit scam/honeypot in which the contract owner could disable the transfer function and restrict users from selling.

How it happened

1. The constructor assigns the supply to the deployer and whitelists only the deployer: balances[msg.sender] = totalSupply; allow[msg.sender] = true;.
2. transferFrom requires require(allow[_from] == true);. A holder who was never added has allow[_from] == false, so a router pulling the holder's tokens with transferFrom reverts.
3. transfer has no allow check, so moving tokens with transfer and buying (the pair sending tokens out with transfer) are not blocked by this rule. The code does not show which address was the pair.
4. modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;} hard-codes the controller, which is 0xbd486897…439192 in hexadecimal. It differs from the deployer shown in the deployment record, and transferOwnership only rewrites the unused owner variable, so it cannot move this control.
5. That address can call addAllow(address holder, bool allowApprove) to set allow for any holder, and mint(address miner, uint256 _value) which runs balances[miner] = _value;. mint overwrites a balance without changing totalSupply.
6. What happened: the code does not show any call to addAllow or mint. Only De.Fi's REKT database listing supports the honeypot classification, and it gives no proof link.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract OMI

Protocol links Website

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, ECOMI bscscan.com
• analysis Sourcify match, chain 56 repo.sourcify.dev