ShibaBTC Honeypot

What happened

ShibaBTC (SHIBTC) is a token on BNB Smart Chain at 0x2171b4de…fce882. Only transfer is unrestricted; transferFrom, the function a DEX router uses to pull tokens from a seller, requires allow[_from] == true, and the only address flagged in the constructor is the deployer. Every other holder is therefore unable to have tokens pulled from their balance unless the address hard-coded in the onlyOwner modifier calls addAllow for them.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the owner could disable transfers, restricting users from selling; it gives no loss figure.

How it happened

1. The constructor gives the deployer the entire supply and the only whitelist entry: balances[msg.sender] = totalSupply; allow[msg.sender] = true;. The allow mapping defaults to false for every other address.
2. transferFrom checks that mapping on the token's source address: require(allow[_from] == true);. A holder who approves a router and swaps tokens back to the base asset has them pulled with transferFrom(holder, pool, amount), so the call reverts for any holder not in allow. Plain transfer has no such check, so wallet-to-wallet sends still work. The deployer is in allow, so the deployer's own pulls are not blocked.
3. Only one address can change the whitelist: function addAllow(address holder, bool allowApprove) external onlyOwner, where modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That decimal value is the address 0xbd486897…439192, which is not the deployer address 0x3178A60B…d5e84D shown in the deployment record. The owner variable set in the constructor is not what onlyOwner checks, so transferOwnership does not move this power.
4. What happened: De.Fi's REKT database lists SHIBTC as a honeypot dated 2021-05-17. No transaction showing that address calling addAllow, and no liquidity-removal transaction, was opened for this record.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SHIBTC

Evidence

• report @Token_Sniffer incident report twitter.com
• report Sourcify repository copy of the same source repo.sourcify.dev
• address BscScan verified source, SHIBTC bscscan.com