EpsilonFinance Honeypot

What happened

EpsilonFinance (EPSILON) on BNB Smart Chain, contract 0x6c095b95…88d71e, contains an owner switch, setFeeEnabled, that turns on a sell fee which works out to almost the whole amount sold. With the switch on, a holder's full amount is debited but the pair is credited only the remainder left after the fee, and the fee is not credited to anyone. De.Fi's REKT database lists this token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The deployer is stored as _owner and receives the whole supply; the constructor also creates the pair: .createPair(address(this), uniswapV2Router.WETH());. _feeEnabled starts as false.
2. Only the owner can change the switch: function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }. There is no function to change _owner or give it up.
3. In _transfer the sender is debited the full amount first: _balances[from] = sub(_balances[from], amount);.
4. When _feeEnabled is true, the recipient is the pair and the sender is not the router, _owner or the contract (_feeEnabled && to == uniswapV2Pair && from != address(uniswapV2Router) && from != _owner && from != address(this)), the fee is uint256 fee = mul(div(amount, 100), 100);. This is amount / 100 * 100, i.e. the amount rounded down to a multiple of 100 raw units, so the fee is nearly 100% of the sale.
5. The pair is credited only sub(amount, fee), which is amount % 100 raw units (at most 99 units of a 9-decimal token), and _totalSupply = sub(_totalSupply, fee); removes the fee from supply. A sale of fewer than 100 raw units pays no fee.
6. Because from is the seller in a router-mediated sale (transferFrom(sender, pair, amount)), the from != address(uniswapV2Router) exemption does not help ordinary sellers, while the owner is exempt and can remove liquidity or sell at will. Whether the owner switched the fee on, or when, was not checked in a transaction.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract EPSILON

Evidence

• report @Token_Sniffer incident report twitter.com
• address EpsilonFinance (EPSILON) verified source on BscScan bscscan.com
• analysis Sourcify copy of EpsilonFinance.sol repo.sourcify.dev