Quark Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Quark (QUARK) is a BNB Chain token deployed on 22 April 2021 at 0xf03b5240…c92ed9. Its internal _approve function only stores an allowance when the approving address is the hard-coded deployer 0x4871a312…58E8B7; for every other holder it stores zero while emitting an Approval event with the value 4. A PancakeSwap sale needs the router to move the holder's tokens with transferFrom, which then fails the allowance check, so holders can buy but not sell through the router, while the deployer's own approvals work.

The owner can also mint any amount of QUARK to itself. De.Fi's REKT database lists Quark as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor mints 2,222,222,222 QUARK (4 decimals) to the deployer.
  2. When a holder approves the PancakeSwap router, _approve checks if (owner == address(0x4871a312C9E226192755BEb9f4e4d0d7cd58E8B7)). For any other holder it runs _allowances[owner][spender] = 0; and emits Approval(owner, spender, 4), so the approval appears to succeed but grants nothing.
  3. A router sale calls transferFrom, which subtracts the amount from the zero allowance with sub(amount, "BEP20: transfer amount exceeds allowance") and reverts.
  4. Buys use the pair's transfer to the buyer, which needs no allowance, so buying keeps working.
  5. The hard-coded deployer address keeps normal allowances, so it can still sell through the router. The onlyOwner function mint(uint256) can create unlimited QUARK for the owner. renounceOwnership would remove the mint power, but the allowance exception is tied to a fixed address, not to the owner role.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract QUARK

Evidence

Same attack technique

Browse all hacks →
Ethereum Digital Reserve Currency Loss not disclosed Ethereum ULTRADOGE Loss not disclosed Ethereum Treasure Box Loss not disclosed BNB Chain CUMROCKET CRYPTO Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes