Slime.Finance Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists Slime.Finance (SLME) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. The verified code shows how: the owner can flag any address with setPanCakeSwapReciever, and a flagged address cannot be the recipient of any token transfer. Flagging a liquidity pair address would make every sell into that pair revert, while buys out of the pair would still work.

The code does not show whether the owner flagged any address; that would need a transaction.

How it happened

  1. SlimeFinance mints its whole supply of 68,466 SLME to the deployer in the constructor with _transferTO(msg.sender, 68466e18);, and the deployer is the initial owner.
  2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless), which is public onlyOwner and simply writes PanCakeSwapReciever[_recipient] = _feeless;. It is not limited by canWhitelist, so renounceWhitelist() does not switch it off.
  3. Every transfer path, transfer and transferFrom, goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount). That function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }.
  4. A holder's sell through a DEX router moves tokens from the holder to the pair, so the pair is the recipient. If the owner has flagged the pair address, the call reverts and the earlier balance debit in _transfer is rolled back, so the holder keeps the tokens but cannot sell them.
  5. The same check also blocks any wallet-to-wallet transfer to a flagged address. Transfers to unflagged addresses, including a buy from the pair, are unaffected, and the deployer can hold the unflagged side of the market.
  6. The code includes renounceOwnership(), so the owner could give up this power, but nothing in the source shows that it was exercised or that the pair was flagged. De.Fi's REKT database describes the outcome as the owner being able to disable transfers and stop users selling.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SLME

Evidence

Same attack technique

Browse all hacks →
BNB Chain DAOstreetbets $548 lost Ethereum Kylin Network Loss not disclosed BNB Chain PepeSocks Loss not disclosed BNB Chain OxSocks Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes