gorillapump.net Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

gorillapump.net (GPUMP, BNB Smart Chain, contract 0x777ec62c…5764a7) is a hand-written ERC-20 that gates transferFrom, the function swap routers use to move a holder's tokens, behind a per-address flag. Only the deployer is flagged at construction, so a holder's token spend through a router would revert unless the flag is later set. Plain transfer has no such check.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens. The code allows the flag changes and balance overwrites described below; the sources opened do not show which of them were used or how much holders lost.

How it happened

  1. The constructor sets balances[msg.sender] = totalSupply; and allow[msg.sender] = true;. No other address starts with allow set.
  2. transfer only checks the zero address and the sender's balance (require(balances[msg.sender] >= _value);), so direct transfers are not gated.
  3. transferFrom adds require(allow[_from] == true);. A swap router sells on a holder's behalf by pulling their tokens with transferFrom, so for a holder whose allow flag is false the call reverts.
  4. The flag is changed by addAllow(address holder, bool allowApprove) external onlyOwner. The onlyOwner modifier is require(msg.sender == address(1080614020421183795110940285280029773222128095634));, a hard-coded address that is 0xbd486897…439192 in hex. It is not the owner storage variable, and it differs from the deployer 0x2687803d…70eb67.
  5. The same address can call mint(address miner, uint256 _value), which runs balances[miner] = _value;. That overwrites (does not add to) a holder's balance with any value, up to zero, and leaves totalSupply unchanged.
  6. The contract has no function that changes the hard-coded address or removes these powers. transferOwnership only reassigns the owner variable, which the modifier does not read.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract GPUMP

Evidence

Same attack technique

Browse all hacks →
Ethereum Ramifi.org Loss not disclosed Ethereum Forcedao.com Loss not disclosed BNB Chain ElonHODL Token Loss not disclosed BNB Chain SafeForever Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes