FLEX Honeypot

What happened

FLEX is a BEP-20 token on BNB Chain at 0x0e3dd2d9…298dff, deployed on 8 April 2021 by 0x8FC96fA0…333699 with a fixed 60,000 FLEX supply minted to that address. De.Fi's REKT database lists it as an exit scam/honeypot. The verified source does not switch transfer off globally.

Instead, the owner can flag any address with setPanCakeSwapReciever, and every transfer to a flagged address reverts with "Error: Can not sell this token". Flagging the PancakeSwap pair lets buyers receive tokens from the pool while blocking them from sending tokens back to it, and the deployer address is still the on-chain owner.

How it happened

1. The deployer receives the whole supply in the constructor: _transferTO(msg.sender, 60000e18);, and is the owner.
2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless), an onlyOwner function that sets PanCakeSwapReciever[_recipient] = _feeless; for any address, including the PancakeSwap pair.
3. Every transfer and transferFrom runs _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount).
4. That function checks the recipient: if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. Buys, where the pair is the sender, pass; sells, where the pair is the recipient, revert.
5. The owner can clear the flag or flag other addresses at any time. renounceWhitelist only disables the feeless whitelists and does not cover this flag; renounceOwnership would stop further setPanCakeSwapReciever calls, but ownership has not been renounced, so the owner still decides who can sell.

Protocol details

Classification Token

Protocol Type Lending

Affected asset / contract FLEX

Protocol links Website @flexmeow

Evidence

• report @Token_Sniffer incident report twitter.com
• transaction FLEX contract creation transaction bscscan.com
• address FLEX verified source code bscscan.com
• analysis Sourcify match for 0x0e3dd2d955af5648591935e7675d8a0a11298dff on BNB Chain repo.sourcify.dev
• analysis Flex (flexmeow.com) app homepage flexmeow.com