SUNLIGHT PROTOCOL Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SUNLIGHT PROTOCOL (SUNLIGHT) is a token on BNB Smart Chain, deployed from 0xB4Fcf151…edC42C at contract 0x97c72be4…8e9d43. Its transferFrom requires allow[_from] == true, and the constructor sets that flag only for the deployer. Any other holder fails the check, so a router cannot pull their tokens for a sale, while transfer has no such check.

Only a hardcoded address can set the flag for others. De.Fi's REKT database lists the token as an Exit Scam/Honeypot on Binance dated 2021-04-05 and gives no loss figure.

How it happened

  1. The constructor gives the deployer the supply and the only approval flag: balances[msg.sender] = totalSupply; allow[msg.sender] = true;. The allow mapping defaults to false for everyone else.
  2. approve is ordinary: allowed[msg.sender][_spender] = _value;. A holder can approve a router normally.
  3. transferFrom then adds a hidden gate: require(_value <= allowed[_from][msg.sender]); require(allow[_from] == true);. For a holder whose allow is false it reverts, so a sale that makes the router pull tokens from that holder fails even though the approval succeeded.
  4. transfer has only require(balances[msg.sender] >= _value);, so plain wallet-to-wallet transfers are not blocked by this code.
  5. addAllow(address holder, bool allowApprove) can switch the flag for any address, but it is guarded by modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That literal is 0xbd486897…439192, which differs from the deployer address, and the modifier does not read the owner variable, so transferOwnership would not change who can call it.
  6. mint(address miner, uint256 _value) is under the same modifier and does balances[miner] = _value;. It overwrites a balance without touching totalSupply, so that address can set any holder's balance.
  7. The source header claims the liquidity is locked for 3 months on Unicrypt. No transaction or lock page was opened, so this record does not confirm or refute it.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SUNLIGHT

Evidence

Same attack technique

Browse all hacks →
BNB Chain ElonProtocol Loss not disclosed BNB Chain Constellation Loss not disclosed BNB Chain Neutron Network Loss not disclosed Ethereum TigerSwap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes