GDRAGON Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

GDRAGON (GDRAGON) is a BNB Chain token deployed on 16 May 2021 at 0x09bda2df…266a9e. Every transfer and transferFrom runs through a modifier named burnTokenCheck that lets only the owner, a second privileged address called _safeOwner and owner-whitelisted wallets move tokens freely. Any other holder can only send less than a hidden threshold _sellAmount, which starts at zero and which only the owner can raise, or send to the PancakeSwap router address itself, which is not where a router sale delivers tokens.

The owner can also blacklist and whitelist wallets through functions misleadingly named addApprove and increaseAllowance, and mint new supply to itself. De.Fi's REKT database lists GDRAGON as an exit scam/honeypot, stating that the owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner address passed at deployment and mints the initial supply to it.
  2. The first transfer the owner sends while _owner == _safeOwner makes its recipient the new _safeOwner. If that first transfer is the liquidity deposit, the PancakeSwap pair becomes _safeOwner, so tokens leaving the pair (purchases) pass the check. The owner can also set _safeOwner directly with decreaseAllowance(address).
  3. For an ordinary holder, burnTokenCheck requires amount < _sellAmount, or else sender == _safeOwner || recipient == _unirouter. _sellAmount starts at 0, and a PancakeSwap sale moves tokens from the holder to the pair, not to _unirouter, so the sale reverts with the misleading message "ERC20: transfer amount exceeds balance".
  4. The owner can raise _sellAmount by transferring tokens to itself. A holder who then sends less than that amount to _safeOwner is added to _blackAddress, after which the same router-only rule applies to every later transfer.
  5. addApprove(address[]) blacklists wallets and increaseAllowance(address[]) whitelists them; multiTransfer lets the owner send tokens, whitelist the first approvecount receivers and give the router an unlimited allowance over their balances.
  6. _mint(address, uint256) is public and owner-only, and credits new tokens to _owner whatever account is passed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract GDRAGON

Evidence

Same attack technique

Browse all hacks →
BNB Chain AERION Loss not disclosed BNB Chain X1000 ONLY Loss not disclosed BNB Chain KumaInu Loss not disclosed BNB Chain GDOGE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes