Hoe Coin BSC Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Hoe Coin BSC (t.me/HoeBSC) is a token on BNB Smart Chain at 0xe9b0874f…471ebb, deployed in transaction 0xd5737eba…d44a97. De.Fi's REKT database lists it as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling. In the verified source, transferFrom requires allow[_from] == true, a per-address flag that only the deployer has at construction and that a hard-coded privileged address can change with addAllow.

transfer has no such check. A comment in the source says all LP will be burned; nothing in the code enforces or records that. The sources opened do not include a transaction showing holders being blocked.

How it happened

  1. The constructor sets allow[msg.sender] = true; for the deployer only and gives the deployer the whole supply (balances[msg.sender] = totalSupply;). Every other address starts with allow false.
  2. transferFrom contains require(allow[_from] == true);. Tokens moved on a holder's behalf through an allowance, which is how a DEX router pulls tokens from a seller, revert for any holder whose flag is false. The holder's balance is only debited after that check, so a reverted sale leaves the tokens in place.
  3. transfer has no allow check, so wallet-to-wallet transfers and transfers sent by a pool contract are not affected by this flag.
  4. addAllow(address holder, bool allowApprove) external onlyOwner sets allow[holder] to any value, so the privileged address can exempt chosen addresses from the block or remove an exemption.
  5. onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)). That decimal literal converts to 0xbd486897…439192, which differs from the deployer 0xB51CA5C8…DEc2a6. The modifier never reads the owner variable, so transferOwnership does not change who can call addAllow or mint.
  6. mint(address miner, uint256 _value) external onlyOwner runs balances[miner] = _value;. It overwrites the recorded balance of any address with any value and does not touch totalSupply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract t.me/HoeBSC
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Dextrarius Token Loss not disclosed BNB Chain Yield Goku Token Loss not disclosed BNB Chain LamboPUMP Loss not disclosed BNB Chain CURLYPUFF Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes