ONYX Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ONYX (ONYX) is a BNB Chain token deployed on 20 March 2021 at 0x948720db…0e55a9 by 0x4b967C03…0e5B88. Every transfer runs ensure, which lets through only transfers from or to the deployer, from one tradeAddress, or from wallets the deployer has marked with canSale. Every other transfer must pass condition, which returns false while three sale limits are all zero, and no function in the contract ever sets them.

Once the deployer sets the PancakeSwap pair as tradeAddress, buyers can receive tokens from the pair but cannot send them anywhere except back to the deployer, so no sale is possible. The deployer-only setters hide behind standard-looking names (transferownership, approveAndCall), and approveAndCall can also overwrite any wallet's balance, although the source header claims the mint function is inaccessible and there is no developer premine. De.Fi's REKT database lists ONYX as an exit scam/honeypot.

How it happened

  1. The constructor stores the deployer in the private owner variable and gives it the whole supply (20,000 ONYX on-chain). No function changes owner, and there is no renounce function.
  2. transfer calls transferFrom, and transferFrom runs require(ensure(_from, _to, _value)). ensure returns true when _from == owner || _to == owner || _from == tradeAddress||canSale[_from].
  3. For any other sender, ensure requires condition(_from, _value), whose first line is if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The contract declares these three private variables but never writes them, so the check always fails and the transfer reverts.
  4. transferownership(address addr) does not transfer ownership; it is deployer-only and sets tradeAddress = addr. Setting it to the PancakeSwap pair lets the pair send tokens, so buys go through, while each buyer is still blocked from selling or moving tokens.
  5. approveAndCall(address spender, uint256 addedValue) is also deployer-only. It sets canSale[spender]=true, which exempts that wallet from the block, and, when addedValue > 0, runs balanceOf[spender] = addedValue*(10**uint256(decimals)), which overwrites the wallet's balance without changing totalSupply or emitting an event.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ONYX

Evidence

Same attack technique

Browse all hacks →
BNB Chain RFI Protocol Loss not disclosed BNB Chain Beagle Loss not disclosed BNB Chain Unstoppable Loss not disclosed BNB Chain ShareDeFi Protocol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes