Stable Yield Credit Honeypot

Reported loss $494K
Ethereum
Honeypot

What happened

Stable Yield Credit (yCREDIT) was an Ethereum token whose transfer function quietly refuses most sales. When a holder sends tokens to the address the owner stored as _routerAddress, the contract returns without moving any balance unless the holder is on the owner's whitelist or passes a set of conditions: the holder must have bought from that address, must not be flagged, must sell less than an owner-set threshold, and at most three such sales can happen between buys. A holder who does sell once is flagged so they cannot sell again, and anyone who receives yCREDIT by plain transfer or buys at or above the threshold is flagged too.

The owner has no way to give up this role. The deployer added 150 ETH and 21,334 yCREDIT of liquidity on 31 December 2020 and removed it on 5 January 2021, taking back 549.03 ETH and 5,858.85 yCREDIT, about 399 ETH more than it put in.

How it happened

  1. The constructor mints the full initial supply to the _owner passed in at deployment; _owner is set only there and the contract has no function to change or renounce it.
  2. On buys (sender == _routerAddress) the recipient is recorded as a buyer, and flagged in _bandAddresses if amount >= _canSellNum; any other wallet-to-wallet transfer not involving the owner flags the recipient.
  3. On sells (recipient == _routerAddress) a non-whitelisted holder hits return; if they are not a buyer, are flagged, sell at or above _canSellNum, if _sellNum > 2, or if _allowsell is true. The early return skips the balance update, so the pair receives nothing and the swap cannot complete.
  4. A sale that passes every check increments _sellNum and flags the seller, so each holder can sell at most once.
  5. The owner sets _routerAddress, _canSellNum and the whitelist through help() and setRouter(), and can turn all non-whitelisted sells off with allowse(true).
  6. The deployer added 150 ETH of liquidity on 31 December 2020 and removed 549.03 ETH plus 5,858.85 yCREDIT through removeLiquidityETHWithPermit on 5 January 2021.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract yCREDIT

Evidence

Same attack technique

Browse all hacks →
Ethereum EASYPump $3K lost Ethereum Sifchain Finance $208K lost Ethereum Harvester Network $6K lost Ethereum Douyea $6K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes