T-Rex Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

T-Rex (T-Rex) is a BNB Chain token deployed on 16 May 2021 at 0x61ed1a35…7a7210. Its transferFrom override only succeeds when a flag called trans is true, when the deployer is the sender or recipient, or when the PancakeSwap pair is the sender. trans starts as false, so a holder's sale through the PancakeSwap router, which moves tokens from the holder to the pair with transferFrom, reverts, while purchases from the pair still go through.

The deployer also holds roles that can pause every transfer and mint unlimited tokens, and the contract's renounceOwnership and lockLiquidity functions only emit events without changing any permission or locking any liquidity. De.Fi's REKT database lists T-Rex as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor records the deployer as the immutable address moi, sets trans = false, grants the deployer DEFAULT_ADMIN_ROLE, PAUSER_ROLE and MINTER_ROLE, mints 1,000,000,000,000 T-Rex to the deployer, and creates the PancakeSwap pair.
  2. transferFrom requires trans || moi == sender || moi == recipient || sender == UNI, where UNI is the pair. A router sale calls transferFrom(holder, pair, amount), so it fails for every holder except the deployer while trans is false.
  3. Purchases use the pair's plain transfer to the buyer, which this check does not cover, so buying keeps working.
  4. Only a MINTER_ROLE holder can call setTrans to open sales, and the same role can call piocher(to, amount) to mint any amount to any address.
  5. A PAUSER_ROLE holder can call pause(), and the whenNotPaused hook then blocks every transfer, mint and burn.
  6. renounceOwnership() and lockLiquidity() are public functions that only emit OwnershipRenounced and liquidityLocked events; calling them changes no role and locks no LP tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract T-Rex

Evidence

Same attack technique

Browse all hacks →
BNB Chain JAGUAR Loss not disclosed Ethereum SHIBACOIN Loss not disclosed BNB Chain AERION Loss not disclosed BNB Chain X1000 ONLY Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes