Kylin Network Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This record covers a copycat ERC-20 token that used the name Kylin Network and the ticker KYL, deployed on Ethereum on 25 February 2021 at 0x5f3d5f3c…30610d. It is not the Kylin Network project's own token: Etherscan tags this contract as Fake_Phishing220997 and its deployer, 0x66D967ee…59fB27, as Fake_Phishing193532. Every transfer and transferFrom passes through a modifier named burnTokenCheck.

It lets the owner and a privileged _safeOwner address move tokens freely, and lets any holder send tokens to the owner. Other transfers pass only if the owner has whitelisted the sender, or if the sender is not blacklisted and the amount is below an owner-set threshold. Anything else, including every transfer by a blacklisted holder, may only go to _unirouter, the Uniswap V2 router address, and otherwise reverts with the misleading message "ERC20: transfer amount exceeds balance".

The owner can also mint without limit through a public _mint function. De.Fi's REKT database lists KYL as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor sets both _owner and _safeOwner to the owner and mints the initial supply to it.
  2. The first time the owner sends tokens out while _owner == _safeOwner, the modifier sets _safeOwner = recipient. If that first transfer is the owner adding Uniswap liquidity, the pair becomes _safeOwner. The owner can also point _safeOwner at any address later through the misnamed decreaseAllowance(address).
  3. Transfers sent by _owner or _safeOwner, or sent to _owner, always pass. When _safeOwner is the pair, this is the path buys take, so buying works.
  4. For any other sender the modifier checks three cases. A sender whitelisted through increaseAllowance(address[]) or multiTransfer passes. A sender blacklisted through addApprove(address[]) may only send to _unirouter, the Uniswap V2 router address. Anyone else passes only if amount < _sellAmount, and otherwise may likewise only send to the router.
  5. A Uniswap sale moves tokens from the holder to the pair, not to the router, so it reverts for blacklisted holders and for any sale at or above _sellAmount. _sellAmount starts at 0, so no such sale can pass until the owner raises it with a transfer to itself.
  6. When a non-whitelisted holder does send a small amount to _safeOwner, the same modifier marks that holder as blacklisted, so any later sale fails.
  7. _mint(address, uint256) is public and only checks msg.sender == _owner; it credits the owner's balance with any amount. The contract has no function that renounces or transfers _owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract KYL

Evidence

Same attack technique

Browse all hacks →
BNB Chain Alchemist Loss not disclosed BNB Chain DAOstreetbets $548 lost BNB Chain Slime.Finance Loss not disclosed BNB Chain PepeSocks Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes