SHINKY Honeypot

What happened

SHINKY (SHINKY) is a BNB Chain token at 0xd3d24d1f…f3d1d9, deployed on 2021-05-14 with 70,000,000 tokens at 8 decimals. While the flag ownerLock is true, which it is from deployment, transfer reverts when the recipient equals the stored address prevOwner, and transferFrom stores its first recipient in prevOwner and then reverts for that address. A holder cannot send tokens to the stored address, and the owner can change it or turn the lock off.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-14 and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. Initalization() sets _totalSupply = 7 * 10**7 * 10**8;, credits it to the deployer and sets ownerLock=true;.
2. transfer is wrapped in transferMiddleware(recipient,ownerLock), which runs require(to != prevOwner, "Handling Request"); while the lock is on.
3. transferFrom is wrapped in transferFromMiddleware, which runs if(from != address(0) && prevOwner == address(0)) prevOwner = to; else require(to != prevOwner, "Order TransferFromMiddleware");. The recipient of the first transferFrom becomes prevOwner and every later transferFrom into that address reverts. The code does not show which address that is.
4. A reverted transfer never reaches _transfer, so the holder's _balances entry is not debited and the tokens stay but cannot be sent to prevOwner.
5. The owner can call setOwnerLock(false) to switch both checks off. transferOwnership(address newOwner) only runs prevOwner = newOwner; and does not change _owner, so the owner can also overwrite prevOwner: setting it to address(0) lets the next transferFrom capture a new recipient, and pointing it at an unused address lifts the block.
6. What happened: De.Fi's REKT database lists SHINKY as an Exit Scam/Honeypot. No opened transaction in this review shows the owner changing ownerLock or prevOwner, or removing liquidity.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SHINKY

Evidence

• report Report tokensniffer.com
• address SHINKY verified source on BscScan bscscan.com
• analysis SHINKY Sourcify match repo.sourcify.dev