PegasusCoin Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists PegasusCoin (PEGASUS) on BNB Smart Chain as an exit scam / honeypot. In the verified source, the owner can mark any address as a PanCakeSwapReciever, and _transfer then reverts every transfer whose recipient is marked with "Error: Can not sell this token". Because the revert undoes the whole transfer, a holder's tokens stay in their wallet but cannot be sent to a marked address, such as a pair that has been flagged.

The owner can also hand ownership over or renounce it.

How it happened

  1. The owner calls setPanCakeSwapReciever(address _recipient, bool _feeless), which is onlyOwner and sets PanCakeSwapReciever[_recipient] = _feeless for any non-zero address. The code allows this at any time.
  2. Every transfer and transferFrom goes through _transfer, which debits the sender with _balances[sender] = _balances[sender].sub(amount, ...) and then calls calculateFeesBeforeSend(sender, recipient, amount).
  3. calculateFeesBeforeSend runs if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The revert rolls back the debit in step 2, so the sender keeps their balance and the transfer fails.
  4. Only the recipient is checked. A marked address cannot receive tokens from anyone, while transfers from it, such as a buy that pays out of a pair, are not blocked by this check.
  5. For all other recipients the function returns (amount, 0): no fee is taken and the full amount arrives. The txFee and feeDistributor values are not used by the transfer path.
  6. The supply is minted once, in the constructor: _transferTO(msg.sender, 525e18). There is no public mint. The owner can end the powers in step 1 only by calling renounceOwnership(); the on-chain owner() read on 2026-09-30 is still the deployer 0xcf78df67…834663.
  7. What the code allows is separate from what happened: De.Fi's REKT database lists the token as a honeypot, but no transaction showing a setPanCakeSwapReciever call, or which address was marked, was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PEGASUS

Evidence

Same attack technique

Browse all hacks →
BNB Chain MHP88 Loss not disclosed BNB Chain SUPPLYSWAP Loss not disclosed BNB Chain BSCView Loss not disclosed BNB Chain ApeShiba Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes