Patrigio Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Patrigio (PTG) is a BEP-20 token on BNB Smart Chain whose Ownable base contract contains a transfer lock. While ownerLock is true, the first transferFrom records its recipient as _firstOwner, and from then on every transfer to that address reverts with "Order Is Pending.", whoever the sender is. Only the owner can switch the lock off.

De.Fi's REKT database lists PTG as an exit scam / honeypot dated 2021-05-14 and describes the owner as able to disable transfers so holders cannot sell; it gives no loss figure.

How it happened

  1. The Ownable constructor sets ownerLock = true, and the Patrigio constructor mints the whole supply to the deployer.
  2. transfer calls _transfer(_msgSender(), recipient, amount, true) and transferFrom calls _transfer(sender, recipient, amount, false). Both run the transferMiddleware modifier.
  3. With the lock on, the first call that is a transferFrom with a non-zero sender takes the branch if(from != address(0) && _firstOwner == address(0) && !handler) _firstOwner = to; and succeeds, storing its recipient as _firstOwner. The code does not say who that recipient is.
  4. Every later call, from any sender including the owner, hits else require(to != _firstOwner, "Order Is Pending.");. A transfer to _firstOwner reverts before _balances[sender] is debited. Transfers to other addresses are unaffected. If _firstOwner is a liquidity pool, then selling into it reverts; the source does not show that it is.
  5. _firstOwner has no setter, so it cannot be changed once stored. The only release is setOwnerLock(bool _ownerLock) onlyOwner, which can turn the lock off (and back on).
  6. renounceOwnership() sets _owner to the zero address with no way back, so if it were called while ownerLock is true, setOwnerLock could never run again. lock(uint256 time) also zeroes _owner, but only for a while: unlock() lets _previousOwner restore ownership once block.timestamp > _lockTime. The code allows both; the source does not show that either was called.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PTG

Evidence

Same attack technique

Browse all hacks →
Ethereum Cheetah Coin Loss not disclosed BNB Chain LILDOG Loss not disclosed BNB Chain ShinyDoge Loss not disclosed BNB Chain JizzUs Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes