Garbage Disposal Honeypot

What happened

Garbage Disposal (GDI) is a BEP20 token on BNB Smart Chain, 0xaac5468b…400146, deployed in transaction 0x3c4d41d2…5000c4 on 2021-04-13. De.Fi's REKT database lists it as an Exit Scam/Honeypot. Its internal _approve function writes a real allowance only when the approving address is the hard-coded wallet 0xE5FAd933…0ECEe5, which is also the deployer; for every other address the allowance is set to zero.

Because every transferFrom call deducts from that allowance, router-based swaps of GDI by any other holder revert, while plain transfer calls are not restricted.

How it happened

1. The constructor mints the whole supply of 2500000000000 raw units (4 decimals, 250,000,000 tokens) to the deployer: _balances[msg.sender] = _totalSupply;.
2. approve calls _approve(_msgSender(), spender, amount). Inside _approve, the allowance is only stored for the hard-coded wallet: if (owner == address(0xE5FAd9339f48cE785ce70660870D428f470ECEe5)) { _allowances[owner][spender] = amount;.
3. For any other holder the else branch runs: _allowances[owner][spender] = 0; and an Approval event with value 0 is emitted, so the approval appears to succeed while nothing is granted.
4. transferFrom runs _transfer(sender, recipient, amount) and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). For a non-allowlisted holder the stored allowance is 0, so .sub(amount, ...) reverts for any amount above zero and the whole call is undone.
5. A DEX router sells a holder's tokens by calling transferFrom on the holder's allowance, so such a sale reverts. Plain transfer goes straight to _transfer with no allowance check, so wallet-to-wallet sends and buys that pay out via transfer are not blocked.
6. The code also lets the owner create more supply: function mint(uint256 amount) public onlyOwner returns (bool). The listing does not state whether any liquidity was withdrawn or how much was lost, and no transaction was opened for this record.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract GDI

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source for Garbage Disposal (GDI) bscscan.com
• analysis Sourcify copy of the Garbage Disposal contract repo.sourcify.dev
• analysis De.Fi REKT database listing (proof link: Token Sniffer tweet, returned 404; companion blog post on a no-approval honeypot pattern) cryptot3ddybear.gitlab.io