GoatCoin Honeypot

What happened

GoatCoin (GCOIN) is a BEP20 token on BNB Smart Chain at 0x8c1ba24e…73f54e. Every transfer runs through a burnTokenCheck modifier that lets the owner, a _safeOwner address, whitelisted addresses and anyone sending to the owner pass freely, but reverts any other holder's transfer of _sellAmount or more to a recipient other than the hard-coded _unirouter address. _sellAmount starts at 0, and the owner controls the whitelist, the blacklist and _sellAmount.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the owner could disable transfers, restricting users from selling; it gives no loss figure.

How it happened

1. The constructor sets _owner = owner; _safeOwner = owner; and mints the initial supply to _owner. transfer and transferFrom both call _approveCheck, which runs the burnTokenCheck(sender,recipient,amount) modifier with sender set to the holder.
2. Privileged paths pass. While _owner == _safeOwner, any transfer from the owner passes and sets _safeOwner = recipient. After that, a transfer passes when sender == _owner || sender == _safeOwner || recipient == _owner; an owner self-transfer in that branch also sets _sellAmount = amount. A sender in _whiteAddress passes too.
3. Everyone else is limited. A sender marked in _blackAddress must satisfy require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"), so it can only send to _unirouter. An unlisted sender passes only if amount < _sellAmount; a transfer of _sellAmount or more hits the same require. Because _sellAmount starts at 0, amount < _sellAmount is false for every amount until the owner raises it, and the revert message blames the balance although the balance is not what failed.
4. The owner controls each input: multiTransfer whitelists the first approvecount receivers and approves _unirouter for the maximum amount for them, increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, decreaseAllowance(address safeOwner) replaces _safeOwner, and the public _mint is restricted to _owner and adds to _balances[_owner]. Unlisted holders who send less than _sellAmount to _safeOwner are blacklisted by if(recipient == _safeOwner){_blackAddress[sender] = true; _whiteAddress[sender] = false;}. The source does not show which addresses are listed or what _sellAmount holds.
5. What happened: De.Fi's REKT database lists GCOIN as a honeypot dated 2021-05-18. No transaction showing the owner calling any of these functions, and no liquidity-removal transaction, was opened for this record.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract GCOIN

Evidence

• report @Token_Sniffer incident report twitter.com
• report Sourcify repository copy of the same source repo.sourcify.dev
• address BscScan verified source, GoatCoin bscscan.com