Safe Fortune Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Safe Fortune (SFORT) is a BEP20 token on BNB Smart Chain, deployed from 0x97Bad680…EF452a at contract 0xf3cbaf1a…977b9c. Its _approve function stores an allowance only when the approving address is a hardcoded literal equal to the deployer's address; for every other address it writes zero. Because transferFrom subtracts the amount from that allowance, a normal holder cannot let a router pull tokens for a sale, while the plain transfer path has no such check.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance dated 2021-04-06 and gives no loss figure.

How it happened

  1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply; (_totalSupply = 9990000000000000000 with _decimals = 4).
  2. approve forwards to _approve(_msgSender(), spender, amount). Inside _approve the first parameter is named owner, and the code branches on a hardcoded address: if (owner == address(0x97Bad680C76733fb9e2504ae82B23EF6C5EF452a)) { _allowances[owner][spender] = amount; ... }.
  3. For any other caller the else branch runs: _allowances[owner][spender] = 0; emit Approval(owner, spender, 0);. The approval call succeeds, but the stored allowance stays zero.
  4. transferFrom runs _transfer(sender, recipient, amount) and then _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"). With a zero allowance, any non-zero amount reverts the whole call, which undoes the balance change. A swap that needs a router to pull tokens from the holder through transferFrom therefore fails for every address except the hardcoded one.
  5. transfer contains no such check, so plain transfers between wallets are not blocked by this code. The hardcoded exemption is a literal, not owner(), so transferOwnership would not move it.
  6. Separately, mint(uint256 amount) is onlyOwner and calls _mint(_msgSender(), amount) with no cap, so whoever owner() returns can mint to themselves. renounceOwnership exists. An eth_call on 2026-09-30 returned 0x97bad680…ef452a as owner; that is current state, not proof that a mint happened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SFORT

Evidence

Same attack technique

Browse all hacks →
BNB Chain Hurricane Loss not disclosed Ethereum Avengers NFT Loss not disclosed BNB Chain Aragorn Loss not disclosed BNB Chain SafeWorld Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes