LABRADOR Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

LABRADOR is a BNB Chain token deployed on 12 May 2021 at 0x31879416…6b49de by 0x514142F2…4B62c8. Its overridden transferFrom reverts unless the public flag trans is true, the deployer is the sender or recipient, or the sender is the PancakeSwap pair the constructor creates. trans starts as true, so sales work at launch, but a MINTER_ROLE holder can set it to false with setTrans, after which a holder's router sale, which moves tokens with transferFrom, fails while buys from the pair still go through.

The same role can mint any amount with piocher, and a PAUSER_ROLE holder can pause every transfer. The contract's renounceOwnership and lockLiquidity only emit events and change nothing. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor stores the deployer as the immutable moi, grants it DEFAULT_ADMIN_ROLE, PAUSER_ROLE and MINTER_ROLE, mints 1,000,000,000,000 tokens to it, creates the token/WBNB pair on PancakeSwap and sets trans = true.
  2. The overridden transferFrom runs require (trans || moi == sender || moi == recipient || sender == UNI);, where UNI is the pair. The PancakeSwap router sells by calling transferFrom(holder, pair, amount), so the sale depends on trans for every holder other than the deployer.
  3. setTrans(bool value) requires MINTER_ROLE; once a role holder sets trans to false, holder sales revert.
  4. Buys keep working because the pair pays out through transfer, which the contract does not override, and the deployer's own sales pass because moi == sender.
  5. piocher(address to, uint256 amount) lets a MINTER_ROLE holder mint any amount to any address, and pause() lets a PAUSER_ROLE holder stop all transfers through _beforeTokenTransfer's whenNotPaused.
  6. renounceOwnership() only runs emit OwnershipRenounced(address(0), address(this)); and lockLiquidity() only emits liquidityLocked, so neither gives up any role nor locks any LP tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract LABRADOR

Evidence

Same attack technique

Browse all hacks →
BNB Chain HONEYROCKET Loss not disclosed BNB Chain SpaceXDoge1 Loss not disclosed BNB Chain Winnie-the-Pot Loss not disclosed BNB Chain AlaskanDoge Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes