GAMESTOP Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

GAMESTOP (GME) is a BEP-20 token on BNB Smart Chain at 0xc49bf313…915a9f, deployed on 26 February 2021 with a fixed 10,000,000 GME supply minted to the deployer. Its transfer path calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping. Only the owner can set that flag, through setPanCakeSwapReciever, and unlike the fee whitelist it is not locked by renounceWhitelist.

Flagging the PancakeSwap pair would let holders buy but make every sell revert. De.Fi's REKT database lists GME as an exit scam/honeypot in which the owner could disable transfers and stop users selling.

How it happened

  1. The constructor mints 10,000,000 GME to the deployer through _transferTO, which also makes the deployer the feeDistributor. The deployer is the Ownable owner.
  2. Every transfer and transferFrom runs _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount) before crediting the recipient.
  3. calculateFeesBeforeSend checks if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer to a flagged address fails and the whole transaction reverts.
  4. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and has no canWhitelist check, so the owner can flag or unflag any address at any time.
  5. If the owner flags the GME/BNB PancakeSwap pair, sells (which transfer GME to the pair) revert, while buys (transfers from the pair to a buyer) still succeed.
  6. The owner can give up this power through renounceOwnership; the on-chain owner read on 2026-09-30 is still the deployer.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract GME

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.