Setting Sun Honeypot

What happened

Setting Sun's _approve function only records an allowance when the token owner is one hard-coded address, 0xb204f3b5…1573Ce, which is also the deployer. For every other holder it writes an allowance of 0, so a router sale that calls transferFrom reverts at the allowance subtraction, while buying and plain transfer calls are not affected by that code. De.Fi's REKT database lists Setting Sun as an exit scam/honeypot on BNB Chain dated 2021-04-07 and describes the owner as able to disable transfers so users could not sell.

How it happened

1. The constructor sets _totalSupply = 6900000000000 with _decimals = 3 and credits it all to the deployer through _balances[msg.sender] = _totalSupply;.
2. _approve begins with if (owner == address(0xb204f3b5e6bE48d7402cbE37490f8Dd25A1573Ce)) { _allowances[owner][spender] = amount; and otherwise runs _allowances[owner][spender] = 0; and emits Approval(owner, spender, 0). Any holder other than that address therefore ends up with a zero allowance, whatever amount they approve.
3. transferFrom calls _transfer(sender, recipient, amount); and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"));. For a holder with a zero allowance the sub reverts with that message for any non-zero amount, which undoes the whole call, including the balance change.
4. A router sale pulls the seller's tokens with transferFrom, so it reverts for ordinary holders. transfer calls _transfer directly and has no allowance step.
5. The hard-coded address matches the contract owner read on-chain on 2026-09-30 (0xb204f3b5…1573ce). The contract also has mint(uint256 amount), restricted to onlyOwner, that mints to the caller, and the standard renounceOwnership.
6. What the code allows is separate from what happened: no transaction was opened showing liquidity removal or minting. De.Fi's REKT database lists the token as an exit scam/honeypot.

Protocol details

Classification Exchange (DEX)

Protocol Type Exit Scam/Honeypot

Affected asset / contract SUN

Evidence

• report @Token_Sniffer incident report twitter.com
• report Setting Sun source on Sourcify repo.sourcify.dev
• address Setting Sun verified source on BscScan bscscan.com
• analysis Scam Explained: BSC NoApproval cryptot3ddybear.gitlab.io
• analysis De.Fi REKT database listing for SUN (as imported in meta.json) de.fi