StringFinance.io Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

StringFinance.io (SGF) is a BEP-20 token on BNB Smart Chain with an owner-controlled list called PanCakeSwapReciever. Every transfer, including the transferFrom calls a router makes on a sell, goes through calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" when the recipient is on that list. Only the owner can add or remove addresses, and the setter has no cap and is not covered by the renounceWhitelist switch.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the owner could restrict holders from selling. The code does not show which address, if any, was listed or when.

How it happened

  1. The constructor mints 8500000e18 SGF to the deployer with _transferTO(msg.sender, 8500000e18);.
  2. The owner can mark any non-zero address as a blocked recipient with setPanCakeSwapReciever(address _recipient, bool _feeless), which only checks require(_recipient != address(0), ...) and then runs PanCakeSwapReciever[_recipient] = _feeless;. Unlike setFeelessSender and setFeelessReciever, it is not gated by canWhitelist, so renounceWhitelist() does not disable it.
  3. _transfer, used by both transfer and transferFrom, calls calculateFeesBeforeSend(sender, recipient, amount), which runs if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The sender's balance is debited earlier in _transfer, but the revert rolls that back, so a blocked transfer fails and the holder's balance is unchanged.
  4. A DEX sell sends tokens to the pair, so if the pair address is on the list the sell reverts. Buys, where the pair is the sender and the buyer is the recipient, are not affected unless the buyer is listed. The code does not show whether the pair was ever listed.
  5. The owner can also remove an address with setPanCakeSwapReciever(_recipient, false). renounceOwnership() exists, so the power can be given up. What happened on-chain is not established here; the claim that holders could not sell comes from De.Fi's listing.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SGF

Evidence

Same attack technique

Browse all hacks →
BNB Chain VanillaUnicorn Loss not disclosed BNB Chain ElonGain 1000X Loss not disclosed BNB Chain EXPER Loss not disclosed BNB Chain HAHAHA GO SAFE TOKENS Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes