Governor Network Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This token contract (Governor Network, GVN) runs every transfer through ensure, which only lets the owner, the owner's counterparties, one stored tradeAddress and addresses marked canSale move tokens. Anyone else falls through to condition, which always returns false because its three limit variables are declared but never assigned. A holder who is not on the owner's list therefore cannot sell or send tokens to any address except the owner.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. The source's header comment describes a stableswap protocol with liquidity mining and a locked developer fund; the contract itself contains only this token logic.

How it happened

  1. The constructor sets owner = msg.sender; and credits the whole supply to it with balanceOf[msg.sender] = totalSupply;. owner is private and nothing in the code changes it.
  2. Every transfer calls transferFrom, which requires ensure(_from, _to, _value). ensure returns true early only when _from == owner || _to == owner || _from == tradeAddress||canSale[_from]; otherwise it must pass require(condition(_from, _value)).
  3. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. _saleNum, _minSale and _maxSale are private and never assigned in the source, so they stay 0 and condition always returns false. The require therefore reverts for any sender that is not on the exemption list, including a sale into a liquidity pair, unless the recipient is the owner.
  4. The owner decides who is exempt. transferownership(address addr) only sets tradeAddress = addr; and does not change the owner despite its name. approveAndCall(address spender, uint256 addedValue) sets canSale[spender]=true; and, when addedValue > 0, overwrites balanceOf[spender] = addedValue*(10**uint256(decimals)); without changing totalSupply.
  5. On a DEX, a buy sends tokens from the pair, so it works only if the pair is tradeAddress or canSale. A sell sends tokens from the holder to the pair, so it works only if the holder was marked canSale.
  6. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. No transaction was opened showing which addresses the owner exempted or whether any holder tried to sell.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract GVN

Evidence

Same attack technique

Browse all hacks →
BNB Chain NFTbs Loss not disclosed BNB Chain WenMoon Loss not disclosed Ethereum Charged Particles Protocol Loss not disclosed BNB Chain PandoraBSC Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes