SolaSystem Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

SolaSystem (SOLAM) is an Ethereum token at 0x72735a7d…39cc0f, deployed on 8 April 2021 by 0x57059AbA…946162. Its transfer rules sit in a modifier misleadingly named burnTokenCheck. An ordinary holder can send tokens only when the amount is below an owner-set threshold (_sellAmount, zero by default), when the recipient is the Uniswap router address, or when the holder is on the owner's whitelist.

A Uniswap sale sends tokens to the pair, not the router, so by default every holder's sale reverts. Even when the threshold is raised, a holder who sends less than it to the _safeOwner address is automatically blacklisted, which catches small sales if _safeOwner is the pair. The constructor also emits 15 Transfer events that show 3,000,000 SOLAM going to 8 hard-coded third-party addresses, while every token is in fact credited to the owner.

De.Fi's REKT database lists SOLAM as an exit scam/honeypot and says the owner could disable transfers so that users could not sell.

How it happened

  1. The constructor makes 15 _mint calls to 8 hard-coded third-party addresses (several receive more than one), but _mint credits _balances[_owner] while emitting Transfer(address(0), account, amount), so explorers show 15 Transfer events and holdings at those addresses that do not exist. Because _mint requires msg.sender == _owner, the owner must be the deployer.
  2. Every transfer and transferFrom passes through burnTokenCheck. The owner, the _safeOwner address and transfers to the owner always pass; an owner-to-owner transfer sets _sellAmount, the sell threshold.
  3. The first transfer out of the owner's wallet, or the owner-only decreaseAllowance(address), sets _safeOwner. When that is the Uniswap pair, buys pass because the pair is the sender.
  4. For any other sender, a transfer of amount >= _sellAmount must satisfy require((sender == _safeOwner)||(recipient == _unirouter), ...), which a sale into the pair fails. With _sellAmount at its default of zero, no ordinary holder can sell.
  5. A transfer below _sellAmount to _safeOwner succeeds once but sets _blackAddress[sender] = true, after which that holder is blocked like everyone else.
  6. The owner can whitelist addresses with increaseAllowance(address[]), blacklist them with addApprove(address[]), and airdrop through multiTransfer, which also whitelists the first recipients and sets their router allowance to the maximum. There is no function to change or renounce _owner.
  7. De.Fi's REKT database lists SOLAM as an exit scam/honeypot in which users could not sell; no transaction was opened showing trades or liquidity removal.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SOLAM

Evidence

Same attack technique

Browse all hacks →
BNB Chain HOGtoken Loss not disclosed Ethereum GAMEE Loss not disclosed BNB Chain FLEX Loss not disclosed BNB Chain SafeDream Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes