FairVenus Honeypot

What happened

FairVenus (FAIRVENUS) is a token on BNB Smart Chain, deployed from 0xDbcE039C…eBe2CB at contract 0xb061cfc7…3899b0. Its transferFrom requires allow[_from] == true, and the constructor sets that flag only for the deployer. Any other holder fails the check, so a router cannot pull their tokens for a sale, while transfer has no such check.

Only a hardcoded address can set the flag for others. De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance dated 2021-04-06 and gives no loss figure.

How it happened

1. The constructor gives the deployer the supply and the only approval flag: balances[msg.sender] = totalSupply; allow[msg.sender] = true;. The allow mapping defaults to false for everyone else.
2. approve is ordinary: allowed[msg.sender][_spender] = _value;. A holder can approve a router normally.
3. transferFrom then adds a hidden gate: require(_value <= allowed[_from][msg.sender]); require(allow[_from] == true);. For a holder whose allow is false it reverts, so a sale that makes the router pull tokens from that holder fails even though the approval succeeded.
4. transfer has only require(balances[msg.sender] >= _value);, so plain wallet-to-wallet transfers are not blocked by this code.
5. addAllow(address holder, bool allowApprove) can switch the flag for any address, but it is guarded by modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That literal is 0xbd486897…439192, which differs from the deployer address, and the modifier does not read the owner variable, so transferOwnership would not change who can call it.
6. mint(address miner, uint256 _value) is under the same modifier and does balances[miner] = _value;. It overwrites a balance without touching totalSupply, so that address can set any holder's balance.
7. The source header claims liquidity would be locked for 365 days on Dxsale. No transaction or lock page was opened, so this record does not confirm or refute it.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract FAIRVENUS

Evidence

• report @Token_Sniffer incident report twitter.com
• report Sourcify copy of the same source repo.sourcify.dev
• address BscScan verified source and meta for FairVenus bscscan.com