Player 2 Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Player 2 (PLAYER) was a BNB Chain token deployed on 19 June 2021 whose code lets holders buy but not sell. A modifier with the misleading name PancakeSwabV2Interface records the recipient of the token's first transferFrom as nxOwner. When the owner adds liquidity, that first transferFrom is the router moving tokens into the PancakeSwap pair, so the pair becomes nxOwner.

From then on, any transfer into that address reverts with "PancakeV2 Interface Error" unless it comes from the owner or a hidden second owner, _leaveowner. Buys from the pair still work, but holders cannot sell back into it. The owner does not need to switch anything on: the block is automatic.

renounceOwnership clears only the public owner and leaves _leaveowner able to sell. The fee and max-transaction variables in the contract are never used. De.Fi's REKT database lists Player 2 as a honeypot.

How it happened

  1. The constructor mints the full supply of 10,000,000,000,000,000 PLAYER to the deployer and sets both _owner and a hidden _leaveowner to the deployer.
  2. The first transferFrom from a non-zero sender sets nxOwner = to. When the owner adds liquidity through the router, that recipient is the PancakeSwap pair.
  3. After that, _transfer requires to != nxOwner || from == _owner || from == _leaveowner, so a transfer into the pair reverts unless it comes from the owner.
  4. Buyers can receive PLAYER from the pair, but any sell sends PLAYER to the pair and fails with "PancakeV2 Interface Error".
  5. Only the owner addresses can sell into the pool, so only they can take out the BNB that buyers put in. Calling renounceOwnership would not end this, because _leaveowner keeps both the sell exemption and onlyOwner access.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PLAYER

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonRise Loss not disclosed BNB Chain MoonSquad Loss not disclosed BNB Chain EverRise Token Loss not disclosed Ethereum Hex-Mex Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes