Icy Comet Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Icy Comet (ICOM) is a BEP20 token on BNB Smart Chain with 6 decimals and a supply of 750,000,000 tokens, deployed at 0xded5cf83…917b37 in transaction 0xdd88c277…893f3a on 2021-04-14. Its internal _approve writes the requested allowance only when the token owner is one hard-coded address, 0x423b63cc…dCDA2F, which is also the deployer. For every other holder it stores an allowance of zero, so transferFrom reverts and a DEX router cannot pull the holder's tokens to sell them.

De.Fi's REKT database lists ICOM as an Exit Scam/Honeypot.

How it happened

  1. The constructor mints the full supply to the deployer: _totalSupply = 750000000000000; and _balances[msg.sender] = _totalSupply;, with _decimals = 6.
  2. _approve has a hidden branch: if (owner == address(0x423b63cccA5e4b048Ad6C544D245E97563dCDA2F)) { it stores amount, } else { _allowances[owner][spender] = 0;. approve, increaseAllowance and decreaseAllowance all go through it, so a normal holder's approval of the router succeeds without error but records zero.
  3. transferFrom calls _transfer and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). With a stored allowance of zero, the sub reverts for any amount above zero, which undoes the whole transaction including the balance move. A router sell, which needs an allowance, therefore fails.
  4. Plain transfer does not touch allowances, so wallet-to-wallet sends and a pair paying out tokens to a buyer are not affected by this branch.
  5. The hard-coded address is not read from owner(), so transferOwnership and renounceOwnership do not change who gets working allowances. mint(uint256 amount) public onlyOwner can also mint to the current owner.

The code allows this; what actually happened to holders is only reflected in De.Fi's listing.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ICOM

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.