KoinChurch Honeypot

What happened

De.Fi's REKT database lists KoinChurch (KOIN) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source, the first transferFrom call with a non-zero sender stores its recipient in nxOwner. From then on, with tracing on, any transferFrom or transfer whose recipient is nxOwner reverts, and nxOwner also gains the owner-only functions, including an uncapped balance-minting one.

How it happened

1. The contract declares bool tracing = true; and address nxOwner; (unset, so the zero address). onlyOwner accepts msg.sender == owner || msg.sender == nxOwner.
2. transferFrom uses contextHandler(from, to): if(tracing) { if(from != address(0) && nxOwner == address(0)) nxOwner = to; else require(to != nxOwner, "Order ContextHandler"); }. The first transferFrom with a non-zero from stores its recipient as nxOwner and goes through. Which address that was on chain is not established here.
3. After that, a transferFrom whose recipient is nxOwner reverts with Order ContextHandler. Swap sells normally use transferFrom(holder, pair, amount), so if the stored recipient is the pair, sells revert and the holder's balance is untouched.
4. transfer carries requestHandler(to): if(tracing) require(to != nxOwner, "Handling Request");, so direct transfers to nxOwner also revert while tracing is true. Transfers from nxOwner to others are not restricted.
5. setTracing(bool) is onlyOwner, so the owner or nxOwner can switch the check on or off. emitTransfer(uint256 _input) adds _input to the caller's balance without changing _totalSupply, and _construct() sends the contract's native-coin balance to the caller. renounceOwnership(address _newOwner) has no access control but only writes currentOwner, which nothing else reads.
6. What is documented: only the De.Fi listing. No transaction was opened showing blocked sells or use of these functions.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract KOIN

Evidence

• report @Token_Sniffer incident report twitter.com
• report Token Sniffer reply tweet 1390015526294810624 (De.Fi proof link) x.com
• address BscScan verified source, KOINCHURCH 0x709bec089b5a5b2e7f73d5a29c4506d8c41711a7 bscscan.com
• analysis Sourcify match, KOINCHURCH.sol repo.sourcify.dev