Luxury Finance Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists Luxury Finance (LF) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. In the verified source, transfer has no restriction, but transferFrom (the path a DEX router uses to pull tokens from a seller) requires a per-address flag: require(allow[_from] == true);. Only the deployer is flagged in the constructor, so every other holder's transferFrom reverts until a privileged caller sets their flag through addAllow.

How it happened

  1. The constructor mints the whole supply to the deployer and flags only that address: balances[msg.sender] = totalSupply; and allow[msg.sender] = true;. Every other address starts with allow equal to false.
  2. transfer has no flag check, so a holder can move tokens directly: require(balances[msg.sender] >= _value);. Buying from a pool therefore works, because the pair sends tokens with transfer.
  3. transferFrom adds a gate on the source address: require(allow[_from] == true);. A sale through a router pulls the holder's tokens with transferFrom, so for any holder whose flag is false the call reverts.
  4. The flag can be changed only through function addAllow(address holder, bool allowApprove) external onlyOwner. The onlyOwner modifier compares msg.sender with a hard-coded address, require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which is 0xbd486897…439192. That is not the deployer 0x88cBABb4…e4424c shown in the deploy record, and the owner variable set in the constructor is not what the modifier checks.
  5. The same address can also call mint(address miner, uint256 _value), which overwrites balances[miner] = _value; without touching totalSupply.
  6. What the code allows: whoever controls the hard-coded address decides which holders can sell through a router. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction showing a call to addAllow or mint was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract LF

Evidence

Same attack technique

Browse all hacks →
BNB Chain KURMA Loss not disclosed Ethereum GamyFi Loss not disclosed BNB Chain saferipple Loss not disclosed BNB Chain VanillaUnicorn Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes