PANKY TOKEN Honeypot

What happened

PANKY TOKEN (PANKY) is a BNB Smart Chain token whose _transfer function reverts for ordinary holders while a private TIME flag is true. The flag defaults to true and only the owner can change it with setTIME. De.Fi's REKT database lists the token as an exit scam/honeypot and states that the owner could disable the transfer function, which restricted users in selling their tokens.

The code allows that: a holder moving tokens to anyone other than the owner is rejected, so a sale into a liquidity pair fails.

How it happened

1. The constructor mints the whole supply to the deployer: _mint(msg.sender, 1000000000000000e18);. The deployer is also the Ownable owner.
2. The private flag defaults to on: bool private TIME = true;. Only the owner can change it: function setTIME (bool _bool) public onlyOwner { TIME = _bool; }.
3. Every transfer, including transferFrom used by routers, passes through _transfer, which contains this check: if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. The revert text mentions a 30-minute limit, but the timestamp comparison in the source is commented out, so the revert is unconditional while TIME is true.
4. A holder who sells sends tokens to a pair, so sender is the holder, recipient is not the owner and sender is not pancake. The call reverts. Transfers where the sender is the owner, where the recipient is the owner, or where the sender equals pancake are not blocked. pancake is overwritten with the recipient of any transfer made by the owner (if(sender == owner()){ pancake = recipient; }) and can also be set with addPancake.
5. The owner has further levers in the same function: fire(uint256 TKP) sets MAX, which caps the amount sent to any address marked with POOL (require(amount <= MAX, ...) when SWAP[recipient] and security are set), and GTYA(address,bool) marks an address as a bot, which makes require(amount <=0, "bots......") revert for that sender.
6. Whether and when the owner used these functions is not shown by the source. De.Fi's REKT database lists the token as a honeypot dated 2021-05-18.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract PANKY

Evidence

• report De.Fi REKT database entry for PANKY (proof link: Token Sniffer X post, 404 when fetched) twitter.com
• address BscScan verified source, PANKY TOKEN bscscan.com
• analysis Sourcify repository, chain 56 repo.sourcify.dev