Orion Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Orion (ORION) is a BEP-20 token on BNB Smart Chain at 0x8868beff…594ca9, deployed on 4 April 2021 with 98,367,130,000 ORION credited to the deployer. It is unrelated to Orion Protocol. It uses the "PancakeSwap NoApproval" template: its internal _approve only stores an allowance when the approving wallet is one hard-coded address, the deployer's; for everyone else it stores zero while still emitting an Approval event.

Selling on PancakeSwap needs the router to spend the seller's tokens through transferFrom, which then fails the allowance check, so holders can buy ORION but not sell it through the router. The block is fixed in the code and is not removed by renounceOwnership. De.Fi's REKT database lists Orion as an exit scam/honeypot.

How it happened

  1. The constructor sets _name = "Orion", _symbol = "ORION", _decimals = 3 and credits _totalSupply = 98367130000000 (98,367,130,000 ORION) to the deployer.
  2. approve, increaseAllowance and decreaseAllowance all call _approve. It checks if (owner == address(0x7909740ee137CD3Aa1105d6dd1103D4f2D2E1eEe)) and stores the requested amount only for that address, the deployer.
  3. For any other wallet it runs _allowances[owner][spender] = 0; and emit Approval(owner, spender, 0);, so the approval transaction succeeds but grants nothing.
  4. A PancakeSwap sell makes the router call transferFrom(seller, pair, amount). After moving the tokens, transferFrom subtracts the amount from the zero allowance with .sub(amount, "BEP20: transfer amount exceeds allowance"), which reverts the whole sell.
  5. The deployer's own approvals work, so it can add liquidity and sell through the router. Buys only use the pair's direct transfer to the buyer and succeed.
  6. The check compares against a constant address, not owner(), so renounceOwnership or transferOwnership would not lift it. The owner can also mint any amount to itself; the on-chain supply read on 2026-09-30 still equals the constructor supply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ORION

Evidence

Same attack technique

Browse all hacks →
BNB Chain Helios Project Loss not disclosed Ethereum Gains Associates Loss not disclosed Ethereum Palm.io Loss not disclosed BNB Chain EXODUS Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes