The Crypto Prophecies Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This record covers an Ethereum token at 0xd19ffe68…9654a7, created on 25 April 2021, that uses the name The Crypto Prophecies and the symbol TCP. It is a separate contract from the project's official TCP token, which Etherscan labels at 0x06576eb3…f66db4 with a different deployer. Every transfer and transferFrom on the record's contract passes through a burnTokenCheck modifier that lets through the owner, a second privileged address called _safeOwner, and owner-whitelisted wallets, but requires every other sender to be _safeOwner or to send to the Uniswap V2 router address.

A sale moves tokens from the holder to the Uniswap pair, not to the router, so it reverts with a disguised "ERC20: transfer amount exceeds balance" error, and _mint is public but owner-only. De.Fi's REKT database lists this TCP token as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument and mints the initial supply to it. The contract has no function that changes _owner, so the owner role can never be renounced.
  2. burnTokenCheck lets a transfer through if the sender is _owner or _safeOwner, if the recipient is _owner, or if the sender is on _whiteAddress. While _owner == _safeOwner, the owner's first outgoing transfer also moves _safeOwner to that transfer's recipient.
  3. Any other sender hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance") unless the amount is below _sellAmount. _sellAmount starts at 0, so no amount qualifies, and a sale to the pair reverts.
  4. The owner can raise _sellAmount by transferring tokens to itself. Transfers below that amount then pass, but a transfer to _safeOwner also puts the sender on _blackAddress, after which only the _safeOwner/router condition applies.
  5. The owner can whitelist wallets with increaseAllowance(address[]), blacklist them with addApprove(address[]), reassign _safeOwner with decreaseAllowance(address), and whitelist airdrop recipients while setting their router allowance to the maximum with multiTransfer.
  6. _mint(account, amount) is public but owner-only; it always credits _balances[_owner] while the Transfer event names account as the recipient.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TCP

Evidence

Same attack technique

Browse all hacks →
BNB Chain BitLink Loss not disclosed BNB Chain NftFinal Loss not disclosed Ethereum Mochi.market Loss not disclosed Ethereum SuperMoon Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes