EverRise Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

EverRise Token (RISE) is a BNB Smart Chain contract (0xb4b3215b…2f6266, deployed 2021-06-14 in transaction 0xf2d4e46a…188252) whose transfer and transferFrom both run through a burnTokenCheck modifier. While _sellAmount is 0, an address that is not the owner, not _safeOwner and not whitelisted can only send tokens to one hard-coded address, _unirouter (0x05fF2B0D…608C7F). Any other recipient reverts with the balance-style message ERC20: transfer amount exceeds balance, so holders see an error that looks like an empty wallet.

The owner alone controls the whitelist, the blacklist, _safeOwner and _sellAmount, and can mint to its own balance, so the code lets the owner decide which holders can sell. De.Fi's REKT database lists the token as an exit scam / honeypot dated 2021-06-19, saying the owner could disable the transfer function and that this restricted users in selling their tokens. The verified source has no single switch with that name; the restriction comes from the modifier described below.

No loss figure, attacker address or exploit transaction is established.

How it happened

  1. The constructor sets _owner = owner; and _safeOwner = owner; and mints initialSupply*(10**18) to the owner. There is no function to change _owner and no renounceOwnership, so the owner role is fixed.
  2. transfer and transferFrom both call _approveCheck, which is declared with burnTokenCheck(sender,recipient,amount). Every holder-to-holder move, buy or sell passes through that modifier.
  3. The owner's first outgoing transfer is waved through and moves the privileged slot: if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}else{. After that, _safeOwner is whichever address received it. The owner can also reassign it with decreaseAllowance(address safeOwner), which only requires msg.sender == _owner.
  4. For everyone else the modifier branches as follows. The owner, _safeOwner, or anyone sending to the owner passes (if (sender == _owner || sender == _safeOwner || recipient == _owner){). A whitelisted sender passes to any recipient (if (_whiteAddress[sender] == true){). A blacklisted sender, or an unlisted sender whose amount is not below _sellAmount, hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance");. Because _safeOwner was already handled above, that line means the only recipient such a holder can use is _unirouter.
  5. _sellAmount starts at 0 (uint256 private _sellAmount = 0;), so amount < _sellAmount is never true by default and unlisted holders fall into the _unirouter-only branch. A token sale moves tokens to a pool address, which the code never lists, so such a transfer reverts; a pool sending tokens out to a buyer must itself pass one of the branches above (for example by being _safeOwner).
  6. The owner can change who is trapped. multiTransfer whitelists the first approvecount receivers (_whiteAddress[receivers[i]]=true;), increaseAllowance(address[]) whitelists and un-blacklists, and addApprove(address[]) sets _blackAddress[receivers[i]] = true; and clears the whitelist. A transfer from the owner to itself sets the threshold (if (sender == _owner && sender == recipient){_sellAmount = amount;}), but only once _safeOwner differs from _owner.
  7. If _sellAmount is raised, an unlisted holder can transfer an amount below it, and if the recipient is _safeOwner that holder is blacklisted by the same transaction: if(recipient == _safeOwner){_blackAddress[sender] = true; _whiteAddress[sender] = false;}. The owner can also add supply: function _mint(address account, uint256 amount) public requires msg.sender == _owner and credits _balances[_owner].
  8. What happened is only what the listing states: De.Fi's REKT database records the token as an exit scam / honeypot on 2021-06-19, without a loss figure. The cited Token Sniffer post could not be opened, and no transaction was examined, so the code shows how sells could be blocked, not when or by whom the controls were used.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract RISE

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonSquad Loss not disclosed BNB Chain Player 2 Loss not disclosed Ethereum Hex-Mex Loss not disclosed Ethereum plex Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes