Raydium Protocol Honeypot

What happened

De.Fi's REKT database lists Raydium Protocol (RAYP), a BNB Smart Chain token, as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. The verified code shows how: the owner can flag any address with setPanCakeSwapReciever, and a flagged address cannot be the recipient of any token transfer. Flagging a liquidity pair address would make every sell into that pair revert, while buys out of the pair would still work.

The code does not show whether the owner flagged any address; that would need a transaction.

How it happened

1. RaydiumProtocol mints its whole supply of 75,000,000 RAYP to the deployer in the constructor with _transferTO(msg.sender, 75000000e18);, and the deployer is the initial owner.
2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless), which is public onlyOwner and simply writes PanCakeSwapReciever[_recipient] = _feeless;. It is not limited by canWhitelist, so renounceWhitelist() does not switch it off.
3. Every transfer path, transfer and transferFrom, goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount). That function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }.
4. A holder's sell through a DEX router moves tokens from the holder to the pair, so the pair is the recipient. If the owner has flagged the pair address, the call reverts and the earlier balance debit in _transfer is rolled back, so the holder keeps the tokens but cannot sell them.
5. The same check also blocks any wallet-to-wallet transfer to a flagged address. Transfers to unflagged addresses, including a buy from the pair, are unaffected, and the deployer can hold the unflagged side of the market.
6. The code includes renounceOwnership(), so the owner could give up this power, but nothing in the source shows that it was exercised or that the pair was flagged. De.Fi's REKT database describes the outcome as the owner being able to disable transfers and stop users selling.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract RAYP

Evidence

• report De.Fi REKT database entry, proof link Token Sniffer post twitter.com
• address BscScan verified source, Raydium Protocol (RAYP) bscscan.com
• analysis Sourcify repository copy, chain 56 repo.sourcify.dev