Payship.Finance Honeypot

What happened

De.Fi's REKT database lists Payship.Finance (PSHP) as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source at 0x2a044644…6ac22f on Ethereum, the control is in ensure: every transfer by a sender other than the owner, the tradeAddress or an owner-flagged address must pass condition, and condition returns false while its three limit variables are all zero. Those variables are private and have no setter anywhere in the contract.

How it happened

1. transfer calls transferFrom(msg.sender, _to, _value), so every move of tokens goes through transferFrom, which calls require(ensure(_from, _to, _value)); before any balance changes.
2. ensure lets a transfer through immediately only if _from == owner || _to == owner || _from == tradeAddress||canSale[_from]. Sending tokens to the owner therefore always works. A holder who sends to any other address (a pair or router pulling tokens with transferFrom) is not in that list.
3. For those holders ensure falls to require(condition(_from, _value));. condition begins with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;, and _saleNum, _minSale and _maxSale are declared private with no assignment in the contract, so they stay at 0 and the require reverts for every such transfer. The _onSaleNum, _minSale and _maxSale branches below it cannot be reached.
4. The owner holds the exemptions. approveAndCall(address spender, uint256 addedValue) is require(msg.sender == owner) only and sets canSale[spender]=true;; with addedValue > 0 it also runs balanceOf[spender] = addedValue*(10**uint256(decimals));, which overwrites that address's balance and does not change totalSupply. transferownership(address addr), despite its name, only sets tradeAddress = addr; and leaves owner unchanged.
5. What happened is limited to the listing: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. No transaction, loss figure or liquidity record was opened, so the code shows how holders could be blocked and which addresses could be exempted, not who was exempted or which sales failed.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract PSHP

Evidence

• report De.Fi REKT database listing for PSHP (proof: Token Sniffer post) twitter.com
• address Payship (PSHP) verified source on Etherscan etherscan.io
• analysis Sourcify match for 0x2a044644475256bde3cc33282fb37efd676ac22f repo.sourcify.dev