Interstellar Honeypot

What happened

Interstellar (INT) is a BEP-20 token deployed on BNB Chain on 3 April 2021 (UTC) at 0x1053e37e…0a44e1 by 0x38c2aC90…c46F18, which is still its owner. Its _approve function stores a real allowance only when the approving wallet is that deployer address; for every other holder it writes an allowance of zero while still emitting an Approval event. DEX sales pull tokens with transferFrom, which needs an allowance, so buyers could acquire INT but not sell it through a router, while the deployer could.

The owner also keeps an uncapped mint. De.Fi's REKT database lists Interstellar as an exit scam/honeypot dated 4 April 2021, with no loss figure.

How it happened

1. The constructor mints the whole supply of 1,500,000,000 INT (3 decimals) to the deployer, 0x38c2aC90…c46F18.
2. _approve checks if (owner == address(0x38c2aC908ed57Ea60002508c177a8c8134c46F18)) and stores the requested amount only for that address. For anyone else it sets _allowances[owner][spender] = 0, so an approval transaction succeeds but grants nothing.
3. Buying works, because the pool sends tokens with a plain transfer, which has no allowance check.
4. Selling through a router calls transferFrom, which subtracts the amount from the router's allowance with sub(amount, "BEP20: transfer amount exceeds allowance"). With an allowance of zero this reverts, so the sale fails for every holder except the deployer.
5. The trap is hard-coded, so no owner action is needed to keep it in place. Separately, mint(uint256) is onlyOwner with no cap and the deployer is still the owner; the current total supply equals the constructor amount.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract INT

Evidence

• report @Token_Sniffer incident report twitter.com
• transaction Interstellar contract creation transaction bscscan.com
• address Interstellar (BEP20Token) verified source code bscscan.com
• analysis Sourcify match for 0x1053e37e862acf1e672231146ca64148430a44e1 on BNB Chain repo.sourcify.dev
• analysis Scam explained: BSC no-approval tokens cryptot3ddybear.gitlab.io