$FUCKELON Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

$FUCKELON (FUCKELON) is a BNB Chain token deployed on 17 May 2021 at 0x5f074743…25f2bf by 0x514142F2…4B62c8. Its overridden transferFrom reverts unless the public flag trans is true, the deployer is the sender or recipient, or the sender is the PancakeSwap pair the constructor creates. trans starts as false, so the pair can still send tokens to buyers while a holder's router sale, which moves tokens with transferFrom, fails.

Only a MINTER_ROLE holder can flip trans with setTrans, and the same role can mint any amount with piocher; a PAUSER_ROLE holder can pause every transfer. The contract's renounceOwnership and lockLiquidity only emit events and change nothing. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor stores the deployer as the immutable moi, grants it DEFAULT_ADMIN_ROLE, PAUSER_ROLE and MINTER_ROLE, mints 1,000,000,000,000 tokens to it, creates the token/WBNB pair on PancakeSwap and sets trans = false.
  2. The overridden transferFrom runs require (trans || moi == sender || moi == recipient || sender == UNI);, where UNI is the pair. The PancakeSwap router sells by calling transferFrom(holder, pair, amount), so while trans is false every holder's sale reverts.
  3. Buys pass because the pair pays out through transfer, which the contract does not override, and the deployer's own sales pass because moi == sender.
  4. setTrans(bool value) requires MINTER_ROLE, so only a role holder can open or close sales.
  5. piocher(address to, uint256 amount) lets a MINTER_ROLE holder mint any amount to any address, and pause() lets a PAUSER_ROLE holder stop all transfers through _beforeTokenTransfer's whenNotPaused.
  6. renounceOwnership() only runs emit OwnershipRenounced(address(0), address(this)); and lockLiquidity() only emits liquidityLocked, so neither gives up any role nor locks any LP tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract FUCKELON

Evidence

Same attack technique

Browse all hacks →
BNB Chain Polkally Loss not disclosed BNB Chain DipBitcoin Loss not disclosed BNB Chain Chubby Akita Loss not disclosed BNB Chain GoatCoin Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes