Sunset Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Sunset (SUNS) is a BEP-20 token deployed on BNB Chain on 8 April 2021 at 0x1deae4ca…408738 by 0x620Efa9A…2f82c2. Its transferFrom only moves tokens out of addresses on an allow list, and at deployment only the deployer is on it. DEX sales pull tokens with transferFrom, so holders could buy SUNS but not sell it through a router.

The list, and a mint function that overwrites any address's balance, are controlled by a hard-coded address written as a decimal number, 0xbd486897…439192, not by the visible owner variable. De.Fi's REKT database lists Sunset as an exit scam/honeypot dated 8 April 2021, with no loss figure.

How it happened

  1. The constructor gives the deployer the whole supply and sets allow[msg.sender] = true; no other address starts on the list. The on-chain supply is 1,000,000,000,000,000 SUNS (18 decimals).
  2. transferFrom includes require(allow[_from] == true);. A router sale uses transferFrom to move the seller's tokens into the pair, so it reverts for every holder who is not on the list.
  3. Plain transfer has no such check, so the pair can send tokens to buyers and buying works.
  4. The onlyOwner modifier is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which is 0xbd486897…439192. That address, not the deployer stored in owner, can call addAllow(holder, allowApprove) to let chosen addresses sell, and mint(miner, _value), which sets balances[miner] = _value for any address without changing totalSupply.
  5. transferOwnership only rewrites the owner variable, which the modifier never reads, so changing or appearing to give up ownership would not remove these powers.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SUNS

Evidence

Same attack technique

Browse all hacks →
BNB Chain Southern Cross Loss not disclosed BNB Chain FAPE Loss not disclosed BNB Chain Supernova Loss not disclosed BNB Chain Alpha Andromedae Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes