Snowflake Floki Honeypot

Reported loss $70K
Honeypot

What happened

SnowFlake Floki (SFF) was a BNB Chain token that presented itself as a Floki-themed metaverse casino currency. Its contract lets the owner set the buy and sell tax to any value with no upper limit, pause every transfer, and blacklist any address, and the owner is still the deployer, 0x731E5BB9…fBF44C. A sell tax near 100% leaves the seller with almost nothing, and a total above 100% makes every sell revert.

On 28 December 2021 PeckShield flagged the token as a honeypot with selling disabled while buyers kept arriving. De.Fi's REKT database lists about 70,375 USD lost and says the deployer set the sell tax to 95% and removed liquidity several times, and that the project's website and social accounts were taken down.

How it happened

  1. The constructor mints the whole supply to the deployer, excludes the deployer and the contract from tax, and sets the owner from a constructor argument: _setOwner(_addr[5]);. The owner today is the deployer.
  2. setSellTax(dev, marketing, liquidity, charity) is onlyOwner and stores the four percentages with no bound. In handleTax, a sale to the pair takes baseUnit * sellTaxes[...] for each part, moves that tax from the seller to the contract, and passes on amount -= tax, so the seller's whole amount is still debited.
  3. With the four parts summing to 95, a seller keeps 5% of the tokens they send to the pool. With the sum above 100 the tax exceeds the amount for any sale larger than a few hundred base units, and amount -= tax underflows, which reverts the sale, so the token becomes unsellable for everyone who is not excluded.
  4. The taxed tokens are swapped for BNB and paid to the dev, marketing and charity wallets set by the owner through setTaxWallets, and the liquidity share goes to taxWallets["liquidity"].
  5. The owner can also stop all transfers with pause(), and enableBlacklist blocks an address; _transfer checks msg.sender, the recipient and tx.origin, so a blacklisted holder cannot start any transfer of their own.
  6. PeckShield reported on 28 December 2021 that selling was disabled. De.Fi's listing states the sell tax was set to 95% (0xe8e6680e…f678e5) and liquidity was removed in five transactions.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SFF
Protocol links Website @snowflakefloki

Evidence

Same attack technique

Browse all hacks →
Ethereum Spark Loss not disclosed ValentineFloki $51K lost BNB Chain Internet Computer Loss not disclosed BNB Chain SkyDog Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes