icecreamland.org Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

icecreamland.org (ICEL) is a token on BNB Smart Chain, deployed at 0xfafd469a…9602a0 in transaction 0xc32ec55a…f195ca on 2021-03-30, with a supply of 50,000 tokens. Every transferFrom call, which transfer also uses, runs a check that lets only the owner, transfers to the owner, a tradeAddress and canSale addresses move tokens. All other senders hit a condition function that returns false when its three private limit variables are zero, and nothing in the source ever sets them.

Ordinary holders therefore cannot send tokens anywhere except to the owner. De.Fi's REKT database lists the token as an Exit Scam/Honeypot.

How it happened

  1. The constructor mints the whole supply to the deployer and records it as the owner: owner = msg.sender; and balanceOf[msg.sender] = totalSupply;.
  2. transfer forwards to transferFrom, which calls require(ensure(_from, _to, _value)); before moving any balance. ensure returns true immediately for _from == owner || _to == owner || _from == tradeAddress||canSale[_from].
  3. Any other sender falls through to require(condition(_from, _value));. In condition, the first line is if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The variables _saleNum, _minSale and _maxSale are private, declared without values, and no function in the source writes to them, so they stay zero and the check fails.
  4. A holder selling through a router calls transferFrom(holder, pair, amount), where _from is the holder. The holder is not exempt, so the call reverts and their balance is unchanged. Sending tokens to the owner address is the only transfer such a holder can make.
  5. The owner can exempt addresses: transferownership(address addr) sets tradeAddress, and approveAndCall(address spender, uint256 addedValue) sets canSale[spender]=true. Either could be pointed at the trading pair so that purchases pass; the code does not show whether that was done.
  6. approveAndCall also contains if(addedValue > 0) {balanceOf[spender] = addedValue*(10**uint256(decimals));}. It overwrites any address's balance without changing totalSupply, so the owner can create balances the supply figure does not account for. Nothing opened shows it being used.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ICEL

Evidence

Same attack technique

Browse all hacks →
BNB Chain LURNA Loss not disclosed Ethereum Apron Network Loss not disclosed BNB Chain Icy Comet Loss not disclosed Ethereum OccamFi Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes