Redbean Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Redbean Token is a reflection-style token whose _transfer function contains the line require(tx.origin == to || tx.origin == owner());. A transfer succeeds only if the transaction's originating wallet is the recipient or the owner. A holder selling through a router sends tokens to the pool, which is not the holder's wallet, so the call reverts and the tokens stay unsold; wallet-to-wallet transfers to other people revert the same way.

De.Fi's REKT database lists Redbean Token (RDBT) as an exit scam/honeypot on BNB Smart Chain dated 2021-05-23 and states that the owner could disable the transfer function, restricting users from selling.

How it happened

  1. The constructor gives the whole supply (_tTotal = 100000 * 10**6 * 10**9, 9 decimals) to the deployer, creates the pair with createPair(address(this), _uniswapV2Router.WETH()) and excludes the owner and the contract from fees.
  2. Every transfer path, including transferFrom, ends in the private _transfer, which contains require(tx.origin == to || tx.origin == owner());. The check does not look at from or at who the pair is.
  3. Buy: the pool pays the buyer, and the buyer's wallet started the transaction, so tx.origin == to and the transfer passes.
  4. Sell: the router calls transferFrom(holder, pool, amount). Here to is the pool and tx.origin is the holder, who is not owner(), so the require fails and the whole transaction reverts. Moving tokens to any other wallet fails for the same reason. The owner() account passes in any case, since tx.origin == owner().
  5. The exemption follows owner() at call time. renounceOwnership and lock set _owner to the zero address, which no transaction origin equals, so the exemption would end for everyone; transferOwnership can hand it to another account.
  6. What happened: De.Fi's REKT database lists the token as a honeypot. No transaction showing a blocked sell, victims or a liquidity removal was opened for this record.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract RDBT

Evidence

Same attack technique

Browse all hacks →
BNB Chain BULLRUN Loss not disclosed BNB Chain OnlyFans Loss not disclosed BNB Chain HolyMoon Loss not disclosed BNB Chain BSCstarter Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes