HEXICO Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

HEXICO is an ERC-20 token on Ethereum built on a common honeypot template. Its transfer and transferFrom pass through a burnTokenCheck modifier that lets only the owner, a privileged _safeOwner address and owner-whitelisted wallets move tokens freely. Every other holder's transfer reverts with a fake "ERC20: transfer amount exceeds balance" error unless it goes to the owner or the Uniswap router, or is smaller than an owner-set _sellAmount threshold that starts at 0.

The owner-only management functions carry misleading names (increaseAllowance, decreaseAllowance, addApprove), and a public owner-only _mint adds unlimited tokens to the owner's balance. De.Fi's REKT database lists HEXICO as an exit scam/honeypot, with no loss figure.

How it happened

  1. The constructor sets _owner and _safeOwner to the same address. The owner's first outgoing transfer makes the recipient the new _safeOwner (if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}), and decreaseAllowance(address) lets the owner set _safeOwner directly.
  2. Transfers from the owner or _safeOwner, or to the owner, always pass, as do transfers from wallets the owner adds with increaseAllowance(address[]). A buy from the pool passes when the pool is _safeOwner or whitelisted.
  3. For any other holder, a transfer passes only if amount < _sellAmount; otherwise it runs require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). A Uniswap sale sends tokens to the pair, not the router, so it reverts while _sellAmount is 0.
  4. The owner sets _sellAmount by sending tokens to itself (if (sender == _owner && sender == recipient){_sellAmount = amount;}). A holder who then sends a small amount to _safeOwner is blacklisted automatically, and addApprove(address[]) blacklists any list of wallets outright.
  5. _mint(address, uint256) is public and owner-only with no cap. It credits _balances[_owner] whatever account is passed, while the Transfer event names that account, so the owner can add supply to its own balance. _owner has no setter or renounce function, so these powers cannot be given up.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract HEXICO

Evidence

Same attack technique

Browse all hacks →
Ethereum plex Loss not disclosed BNB Chain ZUMBA MARS Loss not disclosed BNB Chain LOVELY SHIBA Loss not disclosed BNB Chain CleanEnergyToken Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes