Helios Project Honeypot

What happened

Helios Project (HELIOS) is a BEP-20 token on BNB Chain at 0x71b723e4…46b3f9, deployed on 4 April 2021 at 10:33 UTC. De.Fi's REKT database lists it as an exit scam/honeypot (April 2021). The verified source has no switch that turns transfer off.

Instead, _approve stores a real allowance only when the approving wallet is the hard-coded deployer address 0xC629D61d…33101A and writes zero for everyone else, so other holders cannot sell through a DEX router. The owner can also create unlimited new supply with mint.

How it happened

1. A buyer purchases HELIOS on PancakeSwap. The pair pays out with transfer, which only checks balances, so buys go through.
2. To sell, the holder approves the router. approve calls _approve, which sets _allowances[owner][spender] = 0 unless owner is 0xC629D61d…33101A. The approval transaction succeeds but grants nothing.
3. The router then calls transferFrom, which subtracts the sale amount from that zero allowance with sub(amount, "BEP20: transfer amount exceeds allowance"). The subtraction reverts and the whole sale is undone.
4. The hard-coded address is the only wallet whose approvals are recorded, so it alone can sell through the router. As owner it can also call mint(uint256) to add tokens to its own balance.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract HELIOS

Evidence

• report @Token_Sniffer incident report twitter.com
• transaction Helios Project contract creation transaction bscscan.com
• address BEP20Token verified source code bscscan.com
• analysis Sourcify match for 0x71b723e45cfabb72cde7061f5daf6dd9fe46b3f9 on BNB Chain repo.sourcify.dev
• analysis Scam explained: BSC no-approval token cryptot3ddybear.gitlab.io