Himalaya Honeypot

What happened

Himalaya (HIM) was a BNB Chain token whose approve only worked for one hard-coded wallet, the deployer 0x5659A744…028e6c. For every other holder, _approve stores an allowance of 0, so an approval transaction succeeds but grants nothing. Selling through the PancakeSwap router needs transferFrom, which requires an allowance, so holders who bought could not sell that way, while the deployer could.

De.Fi's REKT database lists HIM as an exit scam/honeypot; no transaction data or loss figure for this token was found.

How it happened

1. _approve checks the token owner against a fixed address: if (owner == address(0x5659A744E8A8bA890F3E01d0181D283Fa5028e6c)) { _allowances[owner][spender] = amount;. Only that wallet gets a real allowance.
2. Every other wallet falls into the else branch: _allowances[owner][spender] = 0; emit Approval(owner, spender, 0);. The approval transaction does not revert, but the stored allowance stays 0.
3. A router sell calls transferFrom, which ends with _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"). With a 0 allowance this reverts, so the sale fails. Plain transfer between wallets still works, and buys work because the pair sends tokens with transfer.
4. The deployer's approvals are stored normally, so that wallet can sell into the same pool.
5. The owner can also create new tokens at will: function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount);. There is no supply cap. renounceOwnership exists and would disable mint, but the approval check is tied to a hard-coded address, not to ownership, so renouncing would not lift the sell block. As of 2026-09-30 owner() still returns the deployer.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract HIM

Evidence

• report @Token_Sniffer incident report twitter.com
• address Himalaya (HIM) BEP20Token contract source, BscScan verified code bscscan.com
• analysis Sourcify repository: chain 56, 0xf5a5e19112b8dd63bace03c69acb51f7dc9a21ce (BEP20Token.sol) repo.sourcify.dev
• analysis BSC-SCAM: PancakeSwap NoApproval (cryptot3ddybear blog) cryptot3ddybear.gitlab.io