GAMESTOP Honeypot
What happened
GAMESTOP (GME) is a BEP-20 token on BNB Smart Chain at 0xc49bf313…915a9f, deployed on 26 February 2021 with a fixed 10,000,000 GME supply minted to the deployer. Its transfer path calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping. Only the owner can set that flag, through setPanCakeSwapReciever, and unlike the fee whitelist it is not locked by renounceWhitelist.
Flagging the PancakeSwap pair would let holders buy but make every sell revert. De.Fi's REKT database lists GME as an exit scam/honeypot in which the owner could disable transfers and stop users selling.
How it happened
- The constructor mints 10,000,000 GME to the deployer through
_transferTO, which also makes the deployer thefeeDistributor. The deployer is theOwnableowner. - Every
transferandtransferFromruns_transfer, which callscalculateFeesBeforeSend(sender, recipient, amount)before crediting the recipient. calculateFeesBeforeSendchecksif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer to a flagged address fails and the whole transaction reverts.setPanCakeSwapReciever(address _recipient, bool _feeless)isonlyOwnerand has nocanWhitelistcheck, so the owner can flag or unflag any address at any time.- If the owner flags the GME/BNB PancakeSwap pair, sells (which transfer GME to the pair) revert, while buys (transfers from the pair to a buyer) still succeed.
- The owner can give up this power through
renounceOwnership; the on-chain owner read on 2026-09-30 is still the deployer.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.