ELONFLY Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ELONFLY is a BNB Smart Chain token whose transferFrom only works for senders on an allow list that contains the deployer alone. A holder who sells through a router has the router pull tokens with transferFrom(holder, ...), which reverts because the holder is not on the list, while plain transfer calls and buys from the pair are unrestricted. The functions that can add holders to the list are guarded by a hard-coded address that is different from the deployer address.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-28 and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor mints totalSupply to the deployer and whitelists only the deployer: balances[msg.sender] = totalSupply; and allow[msg.sender] = true;. The allow mapping is false for every other address.
  2. transferFrom ends its checks with require(allow[_from] == true);, so any pull of tokens out of a holder's balance reverts unless that holder is on the list. transfer has no such check.
  3. A sell through a DEX router approves the router and then has it call transferFrom(holder, pair, amount). For an unlisted holder this reverts. A buy moves tokens from the pair to the buyer through the pair's own transfer, which passes. The deployer is listed, so the deployer's transferFrom calls, such as the router pulling tokens for a liquidity add, are not blocked.
  4. addAllow(address holder, bool allowApprove) can list or unlist any address, and mint(address miner, uint256 _value) overwrites any address's balance with balances[miner] = _value; without touching totalSupply. Both use the modifier onlyOwner, which is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), that is address 0xbd486897…439192.
  5. The stored owner variable, set to the deployer, is not used by onlyOwner, so the deployer address 0x4fF423D9…aE51d7 cannot call addAllow or mint from that address. The code does not show who controls the hard-coded address.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ELONFLY

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonExpress Loss not disclosed BNB Chain SafeFLM Loss not disclosed BNB Chain One SG Loss not disclosed BNB Chain SolaceToken Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes