Ethereum 2.0 Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

"Ethereum 2.0" (ETH 2.0) is an Ethereum token deployed on 30 May 2021 at 0x2b094db2…888976 that borrows the name of the Ethereum upgrade but is an unrelated ERC-20. Its transfer check, a modifier named burnTokenCheck, lets the owner, one hidden _safeOwner address and whitelisted wallets move tokens freely, while every other holder's transfer reverts with a fake "transfer amount exceeds balance" error unless it goes to the Uniswap V2 router address. Uniswap sells send tokens to the pair, not the router, so ordinary holders can buy but cannot sell.

The owner can also mint unlimited tokens to itself and edit the whitelist and blacklist through functions disguised as increaseAllowance, decreaseAllowance and addApprove. De.Fi's REKT database lists the token as an exit scam and honeypot, describing it as a contract where the owner could stop holders from selling.

How it happened

  1. The constructor sets _owner = owner; and _safeOwner = owner;, then mints the initial supply to the owner.
  2. The owner's first outgoing transfer, while both slots are equal, moves _safeOwner to the recipient: if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. If that first transfer is the liquidity deposit, the Uniswap pair becomes _safeOwner, and transfers out of the pair (buys) always pass.
  3. Any other sender that is not whitelisted hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance");. _unirouter is hard-coded to 0x7a250d56…F2488D, but a Uniswap V2 sell moves tokens from the holder to the pair, so the check fails and the sell reverts with a misleading message.
  4. The only other path, if (amount < _sellAmount), starts closed because _sellAmount is 0. The owner can open it by sending tokens to itself (_sellAmount = amount;), and a holder who then sells to _safeOwner is blacklisted: if(recipient == _safeOwner){_blackAddress[sender] = true; _whiteAddress[sender] = false;}.
  5. The owner controls the lists and supply: increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, decreaseAllowance(address) sets _safeOwner, and _mint is a public function that credits any amount to _owner. multiTransfer whitelists chosen recipients and sets an unlimited router allowance on their behalf. There is no function to renounce or change _owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ETH 2.0

Evidence

Same attack technique

Browse all hacks →
BNB Chain Forest token Loss not disclosed BNB Chain dogejavu.com Loss not disclosed BNB Chain Moonpad Loss not disclosed BNB Chain NINJA CAT Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes