ROCKETMARS Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ROCKETMARS (RCKTMARS) is a BNB Chain token whose transferFrom only works for senders that a hard-coded controller address has put on an allow list. Only the deployer is on that list at launch, so a router that pulls a holder's tokens with transferFrom reverts. The same address controls addAllow and a mint function that overwrites any balance.

The source header says ownership will be renounced and liquidity burned, but the code contains no function that changes the controlling address. De.Fi's REKT database lists ROCKETMARS as an Exit Scam/Honeypot in which the owner could restrict users from selling.

How it happened

  1. The constructor mints the supply to the deployer and sets allow[msg.sender] = true. No other address is on the list.
  2. transferFrom requires require(allow[_from] == true);. For any holder whose flag is false, a transferFrom that moves their tokens reverts.
  3. A standard router sell pulls the seller's tokens into the pair with transferFrom, so it reverts for a holder who is not allowed. transfer has no allow check, so a purchase, which the pair pays out through transfer, is not blocked by this rule.
  4. addAllow(address holder, bool allowApprove) external onlyOwner can change any holder's flag. onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which is the address 0xbd486897…439192. It does not read the owner variable, so transferOwnership does not move this permission, and there is no renounce function.
  5. The same address can call mint(address miner, uint256 _value), which executes balances[miner] = _value and can set any address's balance to any amount without changing totalSupply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract RCKTMARS

Evidence

Same attack technique

Browse all hacks →
Ethereum Chicken Soup Protocol Loss not disclosed BNB Chain WARONRUGS Loss not disclosed BNB Chain SAFESHITCOIN Loss not disclosed BNB Chain JUMPFROG Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes