MirrorFinance Honeypot

What happened

MirrorFinance (MIRROR) is a BNB Smart Chain token whose _transfer calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping. Only the owner can flag an address, through setPanCakeSwapReciever, so flagging the liquidity pair makes every transfer into the pair revert, including holder sales. De.Fi's REKT database lists the token as an exit scam/honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor mints 1,250,000,000 tokens (_transferTO(msg.sender, 1250000000e18)) to the deployer, who is the initial _owner.
2. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and writes PanCakeSwapReciever[_recipient] = _feeless;. Unlike the whitelist setters, it has no canWhitelist condition, so renounceWhitelist() does not disable it.
3. Every transfer and transferFrom runs _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount).
4. That function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer to a flagged address reverts and the sender's balance is left unchanged.
5. If the owner flags the liquidity pair, a holder selling through a router, which transfers tokens to the pair, hits the revert. Transfers out of the pair, such as purchases, are not affected by this check.
6. The fee code is inert: calculateFeesBeforeSend returns (amount, 0), and seTxFee only changes txFee, which _transfer does not read. The owner can unset a flag with the same setter and can also call renounceOwnership(); the source does not show whether any address was flagged.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MIRROR

Evidence

• report Token Sniffer post cited as the De.Fi proof link (not accessible, 404 via fxtwitter; not relied on) twitter.com
• report Sourcify match of the same source repo.sourcify.dev
• address MirrorFinance verified source on BscScan bscscan.com