Pitbull Classic Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Pitbull Classic (PITCLASSIC) is a SafeMoon-style reflection token deployed on BNB Chain on 12 May 2021 at 0x89a4a071…7b58a4. The owner could disable transfers for ordinary holders: setMaxTxPercent has no lower bound, so setting it to 0 makes every transfer that does not involve the owner revert, while the owner can still sell. The tax and liquidity fee setters have no cap either, and fees summing above 100% make every fee-paying transfer revert.

The code also sends the LP tokens created by its automatic liquidity function to the owner. owner() reads as the zero address today, but the inherited lock/unlock functions can hand ownership back to the previous owner, and no source shows which of these was used. De.Fi's REKT database lists Pitbull Classic as an exit scam/honeypot, saying the owner could disable the transfer function and stop holders from selling.

How it happened

  1. The deployer becomes _owner and receives the full supply of 1,000,000,000,000,000 PITCLASSIC (_rOwned[_msgSender()] = _rTotal). The constructor creates a PancakeSwap pair and excludes the owner from fees.
  2. Every transfer where neither side is the owner must pass require(amount <= _maxTxAmount, "Transfer amount exceeds the maxTxAmount."), and _transfer separately requires amount > 0.
  3. setMaxTxPercent(uint256 maxTxPercent) is onlyOwner and sets _maxTxAmount = _tTotal.mul(maxTxPercent).div(10**2) with no minimum. At 0, every buy and sell by a non-owner reverts, while the owner's own transfers to the pair skip the check.
  4. setTaxFeePercent and setLiquidityFeePercent are onlyOwner with no cap. If the two fees sum to more than 100, tAmount.sub(tFee).sub(tLiquidity) underflows and reverts for every address not excluded through excludeFromFee.
  5. swapAndLiquify adds liquidity with the contract's collected fee tokens and sends the LP tokens to owner(), so that share of pool liquidity stays removable by the owner.
  6. lock(uint256 time) sets _owner to the zero address but keeps _previousOwner, and unlock() restores it after _lockTime. owner() reads as the zero address on 2026-09-30, which is consistent with either renounceOwnership or lock.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PITCLASSIC

Evidence

Same attack technique

Browse all hacks →
BNB Chain Arsenal FC Fan Token Loss not disclosed BNB Chain MechaGodzilla Loss not disclosed BNB Chain MentalHealth Loss not disclosed BNB Chain ElonSperm Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes