phuture.finance Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This record covers a copycat token named "phuture.finance" (PHTR), deployed on Ethereum on 3 June 2021 at 0xc54ac7dd…a0e6b9. It is not the Phuture project's token, whose official address is 0xE1Fc4455…0622dA. Every transfer and transferFrom runs through a modifier named burnTokenCheck.

It lets the owner, an owner-chosen _safeOwner and whitelisted addresses move tokens freely. Any other holder's transfer reverts with a fake "transfer amount exceeds balance" error unless it goes to the Uniswap router address. Because a Uniswap V2 sell sends tokens straight to the pair, not to the router, ordinary holders can buy but not sell.

The owner can also mint unlimited PHTR to itself, and the whitelist, blacklist and _safeOwner setters are disguised as increaseAllowance, addApprove and decreaseAllowance. De.Fi's REKT database lists the token as a honeypot.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument and mints the initial supply (100,000,000 PHTR on-chain) to it.
  2. The owner's first outgoing transfer reassigns _safeOwner to its recipient. If that transfer is the liquidity deposit, the Uniswap pair becomes _safeOwner, and every transfer out of the pair (a buy) is allowed.
  3. For a holder who is not the owner, _safeOwner or whitelisted, burnTokenCheck only lets the transfer through if amount < _sellAmount or the recipient is _unirouter. _sellAmount starts at 0, so sells to the pair, and even wallet-to-wallet transfers, revert with "ERC20: transfer amount exceeds balance".
  4. The owner can raise _sellAmount by transferring tokens to itself. A holder who then sells less than that amount to _safeOwner succeeds once but is added to _blackAddress, and blacklisted addresses can only send to the router.
  5. The owner can whitelist wallets through increaseAllowance(address[]) or multiTransfer, blacklist through addApprove, reassign _safeOwner through decreaseAllowance, and mint more PHTR to itself through the public _mint. So only owner-approved wallets can sell into the pool that buyers fund.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PHTR

Evidence

Same attack technique

Browse all hacks →
Ethereum Formation Finance Loss not disclosed Ethereum Nagasaki Shiba Loss not disclosed BNB Chain Lossless Loss not disclosed BNB Chain NFTQR Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes