LETHE Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

LETHE Token (LETHE) is a BEP-20 token on BNB Smart Chain, deployed from 0x3a6f8A35…EDbB78 in transaction 0xd20ffc2c…9b3370 on 2021-05-20. De.Fi's REKT database lists it as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function and so restrict users from selling. The verified source shows a switch, TIME, that is true at deployment and makes _transfer revert for most senders with a message about one sale per 30 minutes, although no timing check is active.

The owner can flip that switch, set a per-address bot flag, change a size cap and add a fee. The source does not show whether the owner used any of these powers or whether any sale failed.

How it happened

  1. The constructor mints the whole supply to the deployer: _mint(msg.sender, 1000000000000000e18);. TIME starts as bool private TIME = true;.
  2. In _transfer, any transfer whose sender is the owner re-points the pancake variable to the recipient: if(sender == owner()){ pancake = recipient; }. The owner can also set it directly with addPancake(address).
  3. The sell block follows: if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. While TIME is true, a holder who is not the owner cannot send tokens to anyone except the owner, and this includes a sale into a pool pair. The revert is unconditional: the time comparison that would implement the message is commented out (//&& timeNow < transData[sender] + 10 minutes). The reverted call does not debit the holder.
  4. Transfers sent from pancake are exempt, so whichever address pancake holds can send tokens out. The source does not show which address that is; if it is the pool pair, buys pass while sells revert.
  5. setTIME(bool) is onlyOwner, so the owner can switch the block off and on. renounceOwnership() exists in Ownable, but the source does not show whether it was called.
  6. Further owner-only controls: GTYA(address,bool) flags an address in bot, and a flagged sender fails require(amount <=0, "bots......"), which blocks that sender, not the recipient. POOL(address,bool) marks recipients in SWAP, and for those recipients require(amount <= MAX, ...) caps the amount, with fire(uint256) setting MAX. setFee allows up to _newTxFee <= 100, which is 10% because the fee is amount.mul(txFee).div(1000), although the code comment says the fee is capped at 1%.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract LETHE

Evidence

Same attack technique

Browse all hacks →
BNB Chain BOMB Token Loss not disclosed BNB Chain SAFEOXYGEN Token Loss not disclosed BNB Chain TeslaModelS Plaid Loss not disclosed BNB Chain SupHerbs Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes