Telcoin Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

This "Telcoin" (TELC) is a BNB Chain token deployed on 13 April 2021 at 0x82e0439a…6efe72; it borrows the name of the Telcoin (TEL) remittance project but is a separate contract. Every transfer runs through ensure, which lets it pass only when the sender or recipient is the owner, the sender is the owner-set tradeAddress, or the sender is on the owner's canSale list. Anyone else falls through to condition, which returns false because the three sale limits it reads are zero and no function in the contract can set them.

If tradeAddress is the liquidity pair, buys out of the pair succeed while ordinary holders cannot sell into it. The owner can also write any balance with approveAndCall, and the contract has no function to renounce or transfer ownership. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor sets owner = msg.sender and credits the whole supply to the deployer.
  2. transfer forwards to transferFrom, which calls require(ensure(_from, _to, _value)) before moving any balance.
  3. ensure returns true only if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]); otherwise it requires condition(_from, _value).
  4. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The contract declares these three variables but never assigns them, so every transfer from an address outside the exemptions reverts.
  5. The owner-only transferownership(address addr) does not change the owner; it sets tradeAddress. Pointing it at the pair would let the pair send tokens to buyers, while a holder's sale (a transfer from the holder into the pair) still reverts.
  6. The owner-only approveAndCall(spender, addedValue) sets balanceOf[spender] = addedValue*(10**uint256(decimals)) without changing totalSupply and marks the address in canSale, so the owner can create sellable balances for chosen wallets.

Protocol details

Classification Token
Protocol Type Payments
Affected asset / contract TELC
Protocol links Website @telcoin

Security review history

Evidence

Same attack technique

Browse all hacks →
BNB Chain KING TRUMP Loss not disclosed BNB Chain New Deep Thots Loss not disclosed Ethereum Virgin Elon Loss not disclosed BNB Chain Jade Currency Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes