SAFEOXYGEN Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists SAFEOXYGEN Token (OXYGN) on BNB Smart Chain as an exit scam / honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source at 0x0ca49468…50d15e shows how: _transfer reverts any transfer between two non-owner addresses unless the sender equals the pancake address, and the private TIME flag that enables this check starts as true. A holder selling into a liquidity pair is such a transfer, so the sell reverts, while sending tokens to the owner still passes.

Only the owner can turn the check off with setTIME. The deployment transaction is 0xe00ff783…91098f, sent by 0x25740791…8a8369, which is also the owner address the contract reported when read on 2026-09-30.

How it happened

  1. The constructor mints the whole supply to the deployer with _mint(msg.sender, 1000000000000000e18), and the base contract declares bool private TIME = true;, so the transfer gate is active from deployment.
  2. In _transfer, any transfer sent by the owner executes if(sender == owner()){ pancake = recipient; }, so pancake is whichever address the owner last sent tokens to. An owner transfer into a liquidity pair would therefore record that pair as pancake; addPancake can also set it directly.
  3. The gate is if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. A holder who sells moves tokens from the holder to a pair, so neither side is the owner and the sender is not pancake, and the call reverts. Transfers that pass are those from the owner, to the owner, or from the address stored in pancake. The revert message mentions a 30-minute limit, but the timestamp comparison is commented out (//&& timeNow < transData[sender] + 10 minutes), so the code enforces no timing rule.
  4. The owner holds the switch: setTIME(bool _bool) is onlyOwner and flips TIME. Further owner-only controls are GTYA(address, bool), which makes _transfer revert for a flagged sender (if(bot[sender] == true){ require(amount <=0, "bots......"); }), and fire, POOL and setBAR, which set a per-transfer cap (require(amount <= MAX, ...)) on transfers to flagged recipients. setFee accepts values up to 100, which fee = amount.mul(txFee).div(1000) turns into at most 10% (the code comment says 1%); txFee starts at 0. renounceOwnership exists, so the owner could give these controls up, but the source does not show whether it was called.
  5. What the code allows is separate from what happened: no transaction was opened showing who sold, who held pancake, or whether setTIME was ever called, so the page relies on De.Fi's listing for the outcome.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract OXYGN

Evidence

Same attack technique

Browse all hacks →
Ethereum NETVRK Loss not disclosed BNB Chain BOMB Token Loss not disclosed BNB Chain LETHE Token Loss not disclosed BNB Chain TeslaModelS Plaid Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes