SafeCatch Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists SafeCatch (SAFECATCH, BNB Smart Chain, contract 0x86a48733…1d9d0f) as an exit scam/honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source, _transfer calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping. Only the owner can set that flag, for any address and at any time, so the owner can make transfers into a chosen address (for example a trading pair) fail for every sender.

The code shows what the owner can do; this draft cites no transaction showing the flag was set for any address.

How it happened

  1. The Ownable base sets the deployer as owner, and the SafeCatch constructor mints the whole supply of 1000000000000e18 to msg.sender through _transferTO. The on-chain owner read on 2026-09-30 is the deployer address, 0x570a1fc6…7681ec. The contract has no function that mints after construction; burn only destroys the caller's own tokens.
  2. Every transfer and transferFrom goes through _transfer, which debits the sender and then calls calculateFeesBeforeSend(sender, recipient, amount).
  3. That function contains the trap: if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The revert undoes the whole call, so the sender's balance is not reduced. It applies to every sender, including the owner, and to every amount.
  4. The owner controls the mapping through setPanCakeSwapReciever(address _recipient, bool _feeless), marked onlyOwner. Unlike setFeelessSender and setFeelessReciever, it is not gated by canWhitelist, so renounceWhitelist() does not lock it. The owner can set it back to false to lift the block, and the code also has renounceOwnership(), after which the mapping could no longer be changed.
  5. Other code is cosmetic for this mechanism: calculateFeesBeforeSend otherwise returns (amount, 0) and never reads txFee, so the advertised // 0% fees is the only fee behaviour. _transfer also requires amount > 1000 in raw units.
  6. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot where holders were restricted from selling. The proof link could not be opened, and no transaction is cited here showing which address was flagged, when, or whether liquidity was removed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SAFECATCH

Evidence

Same attack technique

Browse all hacks →
Ethereum Xcademy Token Loss not disclosed Ethereum y.at Loss not disclosed BNB Chain SafeStarship Loss not disclosed BNB Chain rock solid Vaults Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes