Pulse Honeypot

What happened

Pulse (PULSE) was a BNB Chain token whose _approve function only records an allowance when the approving wallet is one hard-coded address, the deployer 0xeB967B25…17123B; for every other wallet it stores an allowance of zero. Selling on PancakeSwap requires approving the router and letting it call transferFrom, which then fails because the seller's allowance is zero. Buys succeed because the pool pays out with a plain transfer.

The owner can also mint unlimited new tokens with mint. De.Fi's REKT database lists Pulse as an exit scam / honeypot dated 2021-04-04, the day the contract was deployed.

How it happened

1. The constructor gives the deployer the full supply (_balances[msg.sender] = _totalSupply;).
2. _approve only honours approvals from the deployer: if (owner == address(0xeB967B2514D2dDbe053c0e1791d9E2c1Ab17123B)) { _allowances[owner][spender] = amount; and otherwise sets _allowances[owner][spender] = 0;. Both approve and increaseAllowance go through it.
3. The deployer's own approvals work, so it can let the router pull tokens and add liquidity to the PancakeSwap pool.
4. A buy succeeds because the pool sends PULSE to the buyer through transfer, which has no approval step.
5. A sell through the router calls transferFrom, which moves the tokens and then runs _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"). The seller's allowance is zero, so the whole transaction reverts.
6. renounceOwnership exists, but the approval check names a fixed address rather than the owner, so renouncing would not lift it. The owner can also call mint(uint256 amount) public onlyOwner with no cap.
7. With other holders unable to sell through the router, the deployer can sell or remove liquidity. The sources reviewed do not show whether or when that happened for Pulse.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract PULSE

Evidence

• report @Token_Sniffer incident report twitter.com
• report Token Sniffer post cited by De.Fi as proof twitter.com
• address BEP20Token (Pulse) verified source code at 0x5cfddfc018ece19c545eff7bc0cd4144bceb75d3 bscscan.com
• analysis Sourcify match for 0x5cfddfc018ece19c545eff7bc0cd4144bceb75d3 on BNB Chain repo.sourcify.dev
• analysis BSC-SCAM: PancakeSwap NoApproval cryptot3ddybear.gitlab.io