PandoraBSC Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

PandoraBSC (PDRBSC) is a BNB Chain token deployed on 31 May 2021 at 0xd461c271…054798 with a supply of 1 trillion tokens minted to the deployer. Its transfer hook stores one blocked destination in a hidden variable, nxOwner: the first transferFrom call writes its recipient there, and every later transfer to that address fails unless it comes from the owner. When liquidity is added through a router, that first recipient is normally the trading pair, so holders can buy but cannot sell.

A function named transferOwnership does not transfer ownership at all; it lets the owner point the block at any address, and a second owner slot, _leaveowner, keeps the deployer's powers even after renounceOwnership. De.Fi's REKT database lists PandoraBSC as an exit scam and honeypot, describing it as a contract where the owner could stop holders from selling.

How it happened

  1. The constructor mints the full supply to the deployer: _balances[msg.sender] = _totalSupply;.
  2. Every transfer runs the BeforeTransfer modifier. While nxOwner is still address(0), the first transferFrom stores its recipient: if(from != address(0) && nxOwner == address(0) && fromTransfer) nxOwner = to;. A router adding liquidity calls transferFrom from the owner to the pair, which would make the pair the stored address.
  3. After that, every transfer checks require((to != nxOwner || from == _owner), "Order TransferFromMiddleware");. A sell sends tokens to the pair, so it reverts for everyone except the owner, while buys (transfers out of the pair) still pass.
  4. transferOwnership(address newOwner) only runs nxOwner = newOwner;, so the owner can move the block to any address. The stored address can be read only through previousOwner(), which is itself onlyOwner.
  5. onlyOwner accepts either _owner or _leaveowner, and renounceOwnership clears only _owner. A renounced-looking contract would still let the deployer call owner functions.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PDRBSC

Evidence

Same attack technique

Browse all hacks →
Ethereum Governor Network Loss not disclosed Ethereum Charged Particles Protocol Loss not disclosed Ethereum NYAN INU Loss not disclosed Ethereum EA Sports Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes