Hurricane Honeypot

What happened

Hurricane (HUR) is a BEP20 token on BNB Smart Chain, deployed from 0x805656A8…ada40c at contract 0xb8693595…9038bc. Its _approve function stores an allowance only when the approving address is a hardcoded literal equal to the deployer's address; for every other address it writes zero. Because transferFrom subtracts the amount from that allowance, a normal holder cannot let a router pull tokens for a sale, while the plain transfer path has no such check.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance dated 2021-04-06 and gives no loss figure.

How it happened

1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply; (_totalSupply = 7000000000000 with _decimals = 1).
2. approve forwards to _approve(_msgSender(), spender, amount). Inside _approve the first parameter is named owner, and the code branches on a hardcoded address: if (owner == address(0x805656A8177A87c19D57e4a7eC739778CBada40c)) { _allowances[owner][spender] = amount; ... }. A code comment just above the branch addresses automated trading software.
3. For any other caller the else branch runs: _allowances[owner][spender] = 0; emit Approval(owner, spender, 0);. The approval call succeeds, but the stored allowance stays zero.
4. transferFrom runs _transfer(sender, recipient, amount) and then _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"). With a zero allowance, any non-zero amount reverts the whole call, which undoes the balance change. A swap that needs a router to pull tokens from the holder through transferFrom therefore fails for every address except the hardcoded one.
5. transfer contains no such check, so plain transfers between wallets are not blocked by this code. The hardcoded exemption is a literal, not owner(), so transferOwnership would not move it.
6. mint is onlyOwner, but _mint sets amount = 0 before adding it, so it cannot create new tokens. renounceOwnership exists; an eth_call on 2026-09-30 returned 0x805656a8…ada40c as owner (current state only).

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract HUR

Evidence

• report @Token_Sniffer incident report twitter.com
• report Sourcify copy of the same source repo.sourcify.dev
• address BscScan verified source and meta for Hurricane (HUR) bscscan.com
• analysis Scam explained: BSC NoApproval cryptot3ddybear.gitlab.io