KitKat Honeypot

What happened

KitKat (KitKat) is a BNB Chain token deployed on 4 April 2021 at 0x29e4c45a…2911ef by 0x4DFD3e93…197E81, which still owns it. Its owner can flag any address with setPanCakeSwapReciever, and every transfer to a flagged address reverts with "Error: Can not sell this token". Flagging the PancakeSwap pair would let holders buy but not sell.

The fee settings and the whitelist switch in the code are never used in transfers, and renounceWhitelist does not limit the sell block. De.Fi's REKT database lists KitKat as a honeypot, citing a Token Sniffer alert that is no longer available.

How it happened

1. The KitKat constructor mints all 87,000 KitKat to the deployer, and Ownable makes the deployer the owner.
2. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and sets PanCakeSwapReciever[_recipient] for any address. Unlike the feeless setters, it has no canWhitelist check.
3. Every transfer calls calculateFeesBeforeSend, which runs if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The check is on the recipient, so once the pair is flagged, any transfer into it reverts, which blocks every sale; buys, where the pair is the sender, still go through.
4. seTxFee, setFeeDistributor and the feeless whitelists look like tax controls, but calculateFeesBeforeSend always returns (amount, 0), so no fee is ever charged. renounceWhitelist() only sets canWhitelist = false, which the sell block never checks.
5. renounceOwnership() exists, but the owner read on-chain is still the deployer, so the flag can still be set or cleared.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract KitKat

Evidence

• report Token Sniffer post 1386163504470659074 (seed link) twitter.com
• transaction KitKat contract creation transaction bscscan.com
• address KitKat verified source code bscscan.com
• analysis Sourcify match for 0x29e4c45a0c4615007beb57a994b3c862732911ef on BNB Chain repo.sourcify.dev