ORANGE TOKEN Honeypot

What happened

De.Fi's REKT database lists ORANGE TOKEN (ORNG, BNB Smart Chain, contract 0x6c8da617…15e89b) as an Exit Scam/Honeypot dated 2021-05-22 and says the owner could disable transfers so holders could not sell. In the verified source, _transfer reverts for every sender other than the owner and a stored pancake address while the TIME flag is true. The revert text claims a "1 Sale PER 30 MIN" limit, but the code contains no time comparison, and TIME is true by default.

Only the owner can switch it off.

How it happened

1. bool private TIME = true; is set at deployment, and the whole supply is minted to the deployer in the constructor with _mint(msg.sender, 1000000000000000e18);.
2. The pancake variable (address public pancake;) is never set in the constructor. Two paths write to it, and both depend on the owner. Inside _transfer, if(sender == owner()){ pancake = recipient; } overwrites it with the recipient of every transfer the owner sends. The owner can also set it directly with function addPancake (address input) public onlyOwner { pancake = input; }. So the code does not say which address pancake holds; it is whichever address the owner last sent tokens to or last passed to addPancake, and the owner can repoint it at will.
3. The next check is if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. Any transfer between two non-owner addresses where the sender is not pancake reverts, whatever the amount and whenever the sender last transferred. A holder selling to a pair (sender is the holder, recipient is the pair) hits this revert unless the holder is the owner or pancake. Transfers whose sender is pancake, such as buys if pancake is the pair, are not blocked by this check.
4. The transData timestamps written by saveTransData are never compared against the current time, so the message does not describe a rate limit.
5. Only the owner can lift the block: function setTIME (bool _bool) public onlyOwner { TIME = _bool; }. The owner also has GTYA(address, bool), which flags an address as bot so that require(amount <=0, "bots......") makes every transfer from it revert, and fire(uint256)/POOL(address, bool)/setBAR(bool) to cap the size of transfers to flagged recipients (default cap 10000e18).
6. setFee caps txFee at 100 out of 1000, i.e. 10%; the default is 0. A fee is taken from the recipient's side (amount.sub(fee) credited) while the sender is debited the full amount.
7. Whether the owner called any of these functions is not shown without a transaction. At the 2026-09-30 read, owner in meta.json is still the deployer address, so ownership had not been renounced.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ORNG

Evidence

• report De.Fi REKT database listing (proof link: Token Sniffer post, not openable) twitter.com
• report ORANGE TOKEN source on Sourcify repo.sourcify.dev
• address ORANGE TOKEN verified source on BscScan bscscan.com