Safari.Yield Finance Honeypot

What happened

Safari.Yield Finance (ySAFARI) is a BEP-20 token on BNB Chain whose transfer function contains a hidden sell block. The owner can mark any address as a PanCakeSwapReciever, and every transfer sent to a marked address reverts with "Error: Can not sell this token". Marking the PancakeSwap pair lets buyers receive tokens from the pool while every sale into it fails.

The fee settings in the contract are decorative: txFee is never used and no fee is charged. De.Fi's REKT database lists ySAFARI as an exit scam/honeypot dated 2021-10-04, with no loss figure.

How it happened

1. The constructor mints 5,400,000 ySAFARI to the deployer, who is also the owner.
2. The owner can call setPanCakeSwapReciever(address, true), which is onlyOwner and has no whitelist lock or other limit.
3. Every transfer runs calculateFeesBeforeSend, which reverts when the recipient is flagged: if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }.
4. If the flagged address is the PancakeSwap pair, a sale (the router moving tokens into the pair) reverts, while a buy (the pair sending tokens to a buyer) is not checked and goes through.
5. Holders can only leave by selling into a pool the owner has not flagged. The owner can flag or unflag any address at any time, and ownership has not been renounced: the on-chain owner is still the deployer.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ySAFARI

Evidence

• report @Token_Sniffer incident report twitter.com
• address Safari.Yield Finance (ySAFARI) verified contract, BscScan bscscan.com
• analysis Sourcify match, chain 56, 0xbb7123603d45da2f3dc4b74f2485f853e61ed609 repo.sourcify.dev