Sauron Honeypot

Reported loss $2K
Ethereum
Honeypot

What happened

Sauron (SRN) is an ERC-20 token on Ethereum that blocks ordinary holders from selling and hides a balance-setting backdoor. Its ensure check lets tokens move freely only when the sender is the owner, the Uniswap router or pair, a tradeAddress, or an address flagged in canSale; any other holder's transfer goes through condition, which returns false while the owner's sale limits are all zero, so the transfer reverts. A public function named Approve, callable by the owner or a hard-coded second address, overwrites any account's balance with an arbitrary amount and whitelists it for selling.

On December 9, 2020, address 0xBD0f9a24…E1C764 sold 1,000M SRN, far more than the 10,000 SRN total supply, into the Uniswap pool for about 17.99 ETH in transaction 0xab2c318b…b414b2.

How it happened

  1. The constructor mints 10,000 SRN to the deployer, stores it as the private owner, and pre-approves the Uniswap V2 router to spend the owner's tokens.
  2. Buys succeed because ensure returns true when _from is the router or the Uniswap pair computed by pairFor.
  3. A sale moves tokens from the holder, so ensure falls through to condition. With _saleNum, _minSale and _maxSale all zero, condition returns false and require(condition(_from, _value)) reverts. The owner can set these limits with init to allow only narrow sales, for example a maximum number of transfers per address.
  4. Approve(spender, addedValue) can be called by the owner or by 0xbd486897…439192 (hard-coded as a decimal number). It sets balanceOf[spender] to addedValue times 10^18 without changing totalSupply, and sets canSale[spender] = true so that account can sell.
  5. The owner can also run arbitrary code in the token's storage through delegate, which does a delegatecall to any address, and can whitelist another sender through the misleadingly named Transferownership, which only sets tradeAddress.
  6. On 2020-12-09 at 16:48 UTC, 0xBD0f9a24…E1C764 sold 1,000M SRN through the Uniswap router and received about 17.99 ETH from the pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SRN

Evidence

Same attack technique

Browse all hacks →
Ethereum Yearn Hold Finance $17K lost Ethereum Ren Swap $7K lost Ethereum Keep3r.info $2K lost Ethereum Brother finance $8K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes