TIGER Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

TIGER is a BNB Smart Chain token that overrides transferFrom with a gate controlled by a boolean trans, which starts as false. While it is false, transferFrom works only when the deployer is the sender or recipient, or when the sender is the liquidity pair. De.Fi's REKT database lists the token as an exit scam/honeypot and states that the owner could disable the transfer function, which restricted users in selling their tokens.

The code allows that: a holder selling through a router calls transferFrom with the holder as sender and the pair as recipient, which reverts until a minter-role account sets trans to true.

How it happened

  1. The constructor records the deployer in a private immutable (moi = _msgSender();), sets trans = false;, grants the deployer the admin, pauser and minter roles, and mints 1000000000000 * 10 ** decimals() tokens to the deployer. It also creates the router's pair for the token.
  2. transferFrom is overridden: require (trans || moi == sender || moi == recipient || sender == UNI);, where UNI is uniswapV2Pair.
  3. A sale through a router pulls tokens with transferFrom(holder, pair, amount). With trans false, the holder is not moi, the pair is not moi and the sender is not UNI, so the call reverts. A purchase pays out from the pair; the pair is the sender, which passes the sender == UNI condition when the pair uses transferFrom, and plain transfer is not overridden.
  4. Only an account with MINTER_ROLE can change the gate: function setTrans(bool value) public { require(hasRole(MINTER_ROLE, msg.sender)); trans=value; }. The same role can create tokens with piocher(address to, uint256 amount), which calls _mint(to, amount).
  5. A pauser can also halt all transfers: _beforeTokenTransfer is whenNotPaused, and pause() requires PAUSER_ROLE.
  6. The functions renounceOwnership() and lockLiquidity() are public with no access check and only emit events (OwnershipRenounced, liquidityLocked); they change no state, so calling them gives up no role and locks no liquidity.
  7. The source does not show whether setTrans was ever called. De.Fi's REKT database lists the token as a honeypot dated 2021-05-18.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TIGER

Evidence

Same attack technique

Browse all hacks →
BNB Chain KreamPie Loss not disclosed BNB Chain MoonChain Loss not disclosed BNB Chain ElonCash Loss not disclosed BNB Chain PirateElon Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes