SATANS PLAYHOUSE Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SATANS PLAYHOUSE (666) is a BEP20 token on BNB Smart Chain at 0x33b402ec…357c17. Its _approve function stores an allowance only when the approving account is one hard-coded address, which is also the deployer and current owner(). For every other account the stored allowance is forced to zero, so any transfer that has to spend an allowance, such as a sale through a DEX router, reverts.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The source shows the block, but no sale or liquidity transaction was opened, so how many holders were affected and how much was lost is not established.

How it happened

  1. The constructor mints the whole supply to the deployer: _totalSupply = 1000000000000000000; and _balances[msg.sender] = _totalSupply; with _decimals = 9.
  2. _approve is rewritten so that only one hard-coded account can create an allowance: if (owner == address(0x624179082C37e106d4075272B279F75CFadc48d7)) { _allowances[owner][spender] = amount; That address is the deployer and the current owner() listed in the contract's metadata.
  3. For any other holder the else branch runs: _allowances[owner][spender] = 0; followed by emit Approval(owner, spender, 0);. The holder's approve call succeeds and emits an event, but the stored allowance stays at zero.
  4. transferFrom runs _transfer(sender, recipient, amount); and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"));. For a non-listed holder the allowance is zero, so the sub reverts for any positive amount and the whole call, including the balance move, is undone. A router that pulls tokens with transferFrom therefore cannot complete a sale for such a holder.
  5. transfer calls _transfer directly and has no allowance step, so direct wallet-to-wallet sends and pool payouts made with transfer are not affected by this control. The code also lets the owner call mint(uint256 amount), which adds new tokens to the owner's balance with no cap.
  6. What happened: De.Fi's REKT database lists this token as an Exit Scam/Honeypot dated 2021-04-25. No transaction was opened that shows a failed sale, a liquidity removal or a mint, so those are not claimed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract 666

Evidence

Same attack technique

Browse all hacks →
BNB Chain Pudgy Token Loss not disclosed Ethereum Floyd Crypto Mayweather Loss not disclosed BNB Chain SAFEGUARD Loss not disclosed Ethereum Big Chungus Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes