ElonHODL Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists ElonHODL Token as an Exit Scam/Honeypot on Binance, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source, transfer has no restriction but transferFrom, the call a DEX router uses to pull a holder's tokens, requires allow[_from] == true, and only the deployer is set to true in the constructor. The only function that can set it for others, addAllow, is limited to a hard-coded address that is different from the deployer.

The code shows what the owner can do; it does not show which holders were or were not allowed.

How it happened

  1. The constructor sets owner = msg.sender;, gives the deployer the whole supply (balances[msg.sender] = totalSupply;) and sets allow[msg.sender] = true;. No other address is allowed at deployment.
  2. A plain transfer only checks the balance, so any holder can still send tokens directly to another address: require(balances[msg.sender] >= _value);.
  3. transferFrom additionally requires require(allow[_from] == true);. When a holder approves a router and the router pulls their tokens with transferFrom(holder, pair, amount), the call reverts unless allow[holder] is true. A holder who was never added keeps the full balance but cannot sell through that path.
  4. Only addAllow(address holder, bool allowApprove) external onlyOwner changes allow. The modifier is onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}: a hard-coded address, not the owner variable. The decimal literal converts to 0xbd486897…439192, which differs from the deployer 0x0DA5E771…56a7E3. The transferOwnership function only rewrites the unused owner variable and does not change who passes onlyOwner.
  5. That same address can also call mint(address miner, uint256 _value), which executes balances[miner] = _value;. This overwrites the target's balance with any value, up or down, without changing totalSupply.
  6. The contract has no function showing who is allowed or blocked at any moment, and no transaction was opened that shows addAllow or mint being called. De.Fi's REKT database lists the token as a honeypot where selling was restricted.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ELONHODL

Evidence

Same attack technique

Browse all hacks →
Ethereum Forcedao.com Loss not disclosed BNB Chain gorillapump.net Loss not disclosed BNB Chain SafeForever Loss not disclosed BNB Chain SafeRedux Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes