What happened
PROJECTX (PROJX) was a BNB Chain token (0x42f8c8aa…4d4a3c, deployed on 28 February 2021) with an owner-controlled sell block. The owner can mark any address as a PanCakeSwapReciever, and every transfer to a marked address reverts with "Error: Can not sell this token". Marking the PancakeSwap pool stops all sells while buys, which move tokens out of the pool, keep working.
The flag is separate from the whitelist that renounceWhitelist locks, and the advertised fee settings are never applied. De.Fi's REKT database lists the token as a honeypot exit scam on 28 February 2021 in which the owner restricted users from selling; no loss figure is recorded.
How it happened
- The constructor mints 500,000,000,000 PROJX to the deployer with
_transferTO(msg.sender, 500000000000e18);, andOwnablemakes the deployer_owner. setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwnersetsPanCakeSwapReciever[_recipient]for any address, with no dependency oncanWhitelist.- Every
transferandtransferFromgoes through_transfer, which callscalculateFeesBeforeSend. That function runsif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so once the pool is flagged, any sale into it reverts. Transfers out of the pool are unaffected. - The owner can clear the flag, trade, and set it again at any time, because the setter has no lock.
renounceOwnershipexists; if the owner renounced after flagging the pool, the block would become permanent. seTxFeeand the feeless sender and recipient lists look like fee controls, butcalculateFeesBeforeSendalways returns(amount, 0), so no fee is ever charged.renounceWhitelistonly stops additions to those unused lists and does not affect the sell block.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
