Fei Tribe Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Fei Tribe (TRlBE, spelled with a lowercase l) is an Ethereum token whose name and symbol resemble Fei Protocol's TRIBE but whose code blocks ordinary holders from selling by default. Every transfer and transferFrom passes through the burnTokenCheck modifier. The owner, the _safeOwner address and owner-whitelisted wallets can send freely, and any holder can send to the owner.

While _sellAmount keeps its starting value of 0, every other transfer from an ordinary holder is rejected unless the recipient is the hard-coded Uniswap V2 router address. A Uniswap sale sends tokens to the pair, not the router or the owner, so it reverts with a fake ERC20: transfer amount exceeds balance error. The owner controls whitelist, blacklist and safe-owner setters disguised as allowance functions and a public _mint; the constructor also emits nine mint events naming another address while crediting every token to the owner.

De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument and calls _mint ten times. _mint requires msg.sender == _owner, so deployment only succeeds when the deployer is the owner.
  2. Nine of those calls name 0x8d5ED43d…35d7b9, but _mint always adds to _balances[_owner] and only uses account in the Transfer event, so the owner holds the whole supply while the event log attributes 90% of it to that other address.
  3. The first transfer the owner makes while _owner == _safeOwner reassigns _safeOwner = recipient; the owner can also set it directly with decreaseAllowance.
  4. Any holder can send tokens to _owner, because recipient == _owner passes an early branch. For any other recipient, a holder who is neither whitelisted nor blacklisted meets require((sender == _safeOwner)||(recipient == _unirouter), ...) while _sellAmount is 0. That tests the sender, not the recipient, so sending to _safeOwner reverts and only the router is accepted. Selling through Uniswap moves tokens to the pair, so the sale reverts with a fake insufficient-balance message.
  5. The owner can whitelist wallets with increaseAllowance or multiTransfer (which also pre-approves the router for them), blacklist wallets with addApprove, and mint any amount to itself with _mint.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TRlBE

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonX2 Loss not disclosed BNB Chain KingSwap Loss not disclosed Ethereum HOPE Loss not disclosed BNB Chain Instantly Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes