Shiba Inu Shih Tzu Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Shiba Inu Shih Tzu (SHIT) is a BEP20 token on BNB Smart Chain whose transfer hook, burnTokenCheck, lets only privileged or whitelisted addresses move tokens freely. With the default _sellAmount of 0, any other sender can only send tokens to the hard-coded _unirouter address, and every other transfer reverts with the misleading message "ERC20: transfer amount exceeds balance". The owner can whitelist or blacklist addresses, change the privileged _safeOwner, and mint new tokens to the owner.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the contract owner could disable the transfer function, restricting users from selling their tokens.

How it happened

  1. Both transfer and transferFrom call _approveCheck, which is wrapped in modifier burnTokenCheck(address sender, address recipient, uint256 amount).
  2. Privileged senders pass: if (sender == _owner || sender == _safeOwner || recipient == _owner) lets the call through. While _owner == _safeOwner, the first transfer sent by _owner runs _safeOwner = recipient, so that recipient becomes the privileged _safeOwner; the owner can also set it with decreaseAllowance(address safeOwner).
  3. Whitelisted senders pass: if (_whiteAddress[sender] == true){ _; }. The owner adds addresses with increaseAllowance(address[] memory receivers), which also clears their blacklist flag, or through the first approvecount receivers of multiTransfer.
  4. Everyone else hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). _sellAmount starts at 0, so amount < _sellAmount is false, and an ordinary sender is not _safeOwner, so the recipient has to equal the stored _unirouter address. A transfer to any other recipient reverts, whatever the holder's balance. Which address a given sell path sends tokens to is not shown by the code.
  5. The owner has more levers: addApprove(address[] memory receivers) sets _blackAddress[...] = true, which routes blacklisted senders into the same _unirouter-only test; a transfer by the owner to itself sets _sellAmount = amount, after which smaller non-whitelisted transfers pass but any whose recipient == _safeOwner blacklist the sender; and _mint is public with require(msg.sender == _owner, ...) and adds to _balances[_owner] and _totalSupply.
  6. What happened: De.Fi's REKT database lists this token as a honeypot/exit scam. No transaction showing the owner calling these functions, a failed sell, a mint, or liquidity removal was opened, and no loss figure is given.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SHIT

Evidence

Same attack technique

Browse all hacks →
BNB Chain 1000xCoin Loss not disclosed BNB Chain Centrifuge Loss not disclosed BNB Chain DogeStar Loss not disclosed BNB Chain SPACEDOGE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes