What happened
SUPPLYSWAP (SUPPLY) was a BEP-20 token on BNB Chain, deployed on 13 March 2021 with a fixed supply of 1,000 tokens minted to the deployer. Its transfer logic lets the owner flag any recipient address with setPanCakeSwapReciever; every transfer to a flagged address reverts with "Can not sell this token". Flagging the token's PancakeSwap pair would block every sale, because a sale sends tokens to the pair, while buys out of the pair still go through.
The flag can be switched on and off at any time, has no lock or delay, and is not limited by the renounceWhitelist switch. De.Fi's REKT database lists SUPPLY as an exit scam/honeypot in which the owner could block users from selling; no transaction showing the flag being set was opened.
How it happened
- The constructor mints all 1,000 SUPPLY to the deployer, who becomes
ownerand can seed a PancakeSwap pool. - The owner can call
setPanCakeSwapReciever(pair, true). The function only checksonlyOwnerand a non-zero address. - On every transfer,
_transfercallscalculateFeesBeforeSend, which runsif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. - A buy sends SUPPLY from the pair to the buyer, so it is unaffected. A sell sends SUPPLY from the holder to the pair, so it reverts and the holder cannot exit.
- Because the owner can clear the flag with
setPanCakeSwapReciever(pair, false), the owner can reopen selling for itself at will;renounceOwnershipexists but the deployer was still the owner when the chain was read on 2026-09-30.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
