InfinitySwap Honeypot
What happened
InfinitySwap (INFNTY) on BNB Smart Chain contains an owner-controlled switch that blocks transfers to chosen addresses. setPanCakeSwapReciever(address _recipient, bool _feeless) lets the owner mark any address in the PanCakeSwapReciever mapping, and _transfer calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is marked. If the owner marks the trading pair, every sell into it reverts while buys, which come from the pair, are unaffected.
The owner can flip the flag back at any time, and renouncing the whitelist does not touch it. De.Fi's REKT database lists INFNTY as an Exit Scam/Honeypot, noting that the owner could disable the transfer function and restrict users from selling; the proof link could not be retrieved, so no specific marked address, sale attempt or loss figure is verified here.
How it happened
What the code allows (no transaction was opened, so which addresses the owner actually marked is not verified):
- The constructor mints the whole supply to the deployer, who also becomes owner:
_transferTO(msg.sender, 100000000e18);withOwnablesetting_owner = _msgSender();. - The owner can mark any address as a blocked recipient:
function setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner { ... PanCakeSwapReciever[_recipient] = _feeless; }. Unlike the feeless setters, it is not guarded bycanWhitelist, sorenounceWhitelist()does not disable it. - Every transfer, including
transferFromused by routers, goes through_transfer, which callscalculateFeesBeforeSend(sender, recipient, amount). That function containsif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. - The check looks at the recipient only, with no exemption for the owner or any sender. When the recipient is a marked address such as a trading pair, a holder's sell reverts and the sender's balance is restored, because the debit in
_transferhappens in the same reverted transaction. Transfers into unmarked addresses and transfers out of a marked address are not affected by this check. - The flag is reversible (
PanCakeSwapReciever[_recipient] = _feeless;acceptsfalse), so the owner can unmark the pair.renounceOwnership()exists; calling it would freeze the flag in its current state.
The fee machinery is inert: calculateFeesBeforeSend ends with return (amount, 0);, so no fee is taken on any transfer.
De.Fi's REKT database lists INFNTY as an Exit Scam/Honeypot dated 2021-09-21, noting that the owner could disable the transfer function and restrict users from selling.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.