Iron Mars Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Iron Mars (IMARS) on BNB Smart Chain, contract 0xb8323e38…9de103, wraps transfer and transferFrom in middleware that reverts any transfer whose recipient equals the stored prevOwner address. prevOwner is empty at deployment and is filled by the first transferFrom call, with whatever recipient that call has, so if that call supplies liquidity to a trading pair, later sells into the pair revert. The owner-only setTrustedOwner(false) switches the middleware off, and transferOwnership repoints prevOwner instead of changing the owner.

De.Fi's REKT database lists the token as an exit scam/honeypot and says the contract owner could disable the transfer function, which restricted users from selling.

How it happened

  1. The Ownable constructor sets _owner to the deployer and trustedOwner = true, which turns the transfer middleware on. prevOwner is empty.
  2. transferFrom carries transferFromMiddleware(sender, recipient, trustedOwner). While trustedOwner is true, the first call with a non-zero from runs if(from != address(0) && prevOwner == address(0)) prevOwner = to; and records the recipient. The modifier then continues and the tokens move. If that call is the liquidity add, prevOwner is the pair.
  3. After that, transferFrom takes the other branch: else require(to != prevOwner, "Order TransferFromMiddleware");, and transfer carries require(to != prevOwner, "Handling Request");. A sell through a router is a transferFrom(holder, pair, amount). The modifier reverts before _transfer runs, so the holder's balance is not debited and the tokens stay in the wallet.
  4. Transfers to any other recipient still work, for example a pair paying out to a buyer.
  5. The owner controls the block. setTrustedOwner(bool _trustedOwner) onlyOwner can set trustedOwner to false, which skips both checks. transferOwnership(address newOwner) only runs prevOwner = newOwner;, so it repoints the blocked address: the zero address re-arms the capture at the next transferFrom, an unused address lifts the block. renounceOwnership sets _owner to the zero address but does not touch trustedOwner or prevOwner.
  6. Separately, the owner-only forceLiquiditySync(uint256 _amount) credits _amount to the owner and raises _totalSupply, so the supply is not fixed.
  7. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-06-01. No opened source shows the value of prevOwner, any failed sell, any use of the owner functions, or any loss figure.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract IMARS

Evidence

Same attack technique

Browse all hacks →
BNB Chain BlueOrigin Loss not disclosed Ethereum Ethereum Apex Loss not disclosed BNB Chain One Loss not disclosed BNB Chain NFTbs Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes