SHIBA PROTOCOL Honeypot

What happened

SHIBA PROTOCOL (SHIBPRO) was a BNB Smart Chain honeypot token, listed by De.Fi's REKT database on April 26, 2021, the day it was deployed. Its transferFrom only works for addresses on an allow list, and only the deployer is on that list at launch, so holders can receive tokens from a PancakeSwap buy but cannot sell, because a router sell pulls tokens with transferFrom. The allow list and a mint function that overwrites any balance are controlled by a hard-coded address, not by the owner variable, so the visible transferOwnership does not remove that control.

How it happened

1. The constructor gives the deployer the whole supply and sets allow[msg.sender] = true; no other address is allowed.
2. transferFrom contains require(allow[_from] == true);. Plain transfer has no such check, so buys, where the pair sends tokens with transfer, succeed.
3. Selling on PancakeSwap makes the router call transferFrom(seller, pair, amount). For any holder not on the list the require fails and the sale reverts.
4. addAllow(holder, allowApprove) lets the controller add or remove addresses, and mint(miner, _value) sets balances[miner] = _value to any number without changing totalSupply.
5. Both are guarded by onlyOwner, which is written as require(msg.sender == address(1080614020421183795110940285280029773222128095634)), the hard-coded address 0xbd486897…439192. transferOwnership only updates the unused owner variable, and there is no renounce function, so the control cannot be given up.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SHIBPRO

Evidence

• report Token Sniffer post on X (De.Fi proof link) twitter.com
• address SHIBA PROTOCOL (SHIBPRO) verified contract source, BscScan bscscan.com
• analysis Sourcify match, chain 56, 0xe9f153c513d1473eb6d29891652d8d5bb900cc1a repo.sourcify.dev