OxSocks Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

OxSocks (OXsocks) is a token on BNB Smart Chain (120,000-token supply) that checks every transfer recipient against an owner-controlled mapping, PanCakeSwapReciever. If the recipient is flagged there, calculateFeesBeforeSend reverts with "Error: Can not sell this token", and the revert undoes the whole transfer, including the sender's balance debit. Only the owner can flag addresses, with no limit on how many, and the renounceWhitelist switch does not cover this function.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-05 and says the owner could disable the transfer function, which restricted users in selling their tokens. In the code, the restriction applies to transfers sent to flagged addresses (for example a trading pair, if it were flagged) rather than to every transfer. Which addresses were flagged on-chain is not established by the sources used.

How it happened

  1. The Ownable constructor makes the deployer the owner, and the OxSocks constructor mints the whole fixed supply to it: _transferTO(msg.sender, 120000e18); (120,000 tokens, 18 decimals). There is no other mint path.
  2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless), which does PanCakeSwapReciever[_recipient] = _feeless;. Its only condition is onlyOwner; unlike the fee whitelists it is not gated by canWhitelist, so renounceWhitelist() does not stop it.
  3. transfer and transferFrom both end in _transfer, which debits the sender and then calls calculateFeesBeforeSend(sender, recipient, amount).
  4. That function runs if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. Because the revert rolls back the transaction, the holder's tokens are not taken; the transfer simply fails.
  5. On an AMM, a sale sends the holder's tokens to the pair contract as the recipient, so if the pair address is flagged the sale reverts. A buy sends tokens from the pair to the buyer and is not affected by this check unless the buyer is flagged.
  6. What happened: De.Fi's REKT database lists the token as a honeypot and describes the owner disabling transfers so users could not sell. The proof post (a Token_Sniffer tweet) could not be opened, and the code alone does not show that any address was flagged.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract OXsocks

Evidence

Same attack technique

Browse all hacks →
BNB Chain Slime.Finance Loss not disclosed BNB Chain PepeSocks Loss not disclosed BNB Chain RobotSwap Loss not disclosed BNB Chain WizzardSwap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes