Icy Comet Honeypot
What happened
Icy Comet (ICOM) is a BEP20 token on BNB Smart Chain with 6 decimals and a supply of 750,000,000 tokens, deployed at 0xded5cf83…917b37 in transaction 0xdd88c277…893f3a on 2021-04-14. Its internal _approve writes the requested allowance only when the token owner is one hard-coded address, 0x423b63cc…dCDA2F, which is also the deployer. For every other holder it stores an allowance of zero, so transferFrom reverts and a DEX router cannot pull the holder's tokens to sell them.
De.Fi's REKT database lists ICOM as an Exit Scam/Honeypot.
How it happened
- The constructor mints the full supply to the deployer:
_totalSupply = 750000000000000;and_balances[msg.sender] = _totalSupply;, with_decimals = 6. _approvehas a hidden branch:if (owner == address(0x423b63cccA5e4b048Ad6C544D245E97563dCDA2F)) {it storesamount,} else { _allowances[owner][spender] = 0;.approve,increaseAllowanceanddecreaseAllowanceall go through it, so a normal holder's approval of the router succeeds without error but records zero.transferFromcalls_transferand then_approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). With a stored allowance of zero, thesubreverts for any amount above zero, which undoes the whole transaction including the balance move. A router sell, which needs an allowance, therefore fails.- Plain
transferdoes not touch allowances, so wallet-to-wallet sends and a pair paying out tokens to a buyer are not affected by this branch. - The hard-coded address is not read from
owner(), sotransferOwnershipandrenounceOwnershipdo not change who gets working allowances.mint(uint256 amount) public onlyOwnercan also mint to the current owner.
The code allows this; what actually happened to holders is only reflected in De.Fi's listing.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.