TogetherWeStand Honeypot

What happened

De.Fi's REKT database lists TogetherWeStand (TKEN) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows a size-triggered block: in transferFrom, once the amount exceeds securityLvl, the first recipient is stored in prevOwner and any later transferFrom above the threshold to that address reverts, while transfer to it reverts whenever trustedOwner is true. The owner can change the threshold and the flag, and can mint.

How it happened

1. The Ownable constructor sets trustedOwner = true; and securityLvl = 1000000*10**9;. With 9 decimals that is 1,000,000 tokens (the source comment says "100 000 token"), against a supply of 1 * 10**9 * 10**9, i.e. 1 billion tokens.
2. transferFrom carries transferFromMiddleware(sender, recipient, amount). When amount > securityLvl, the code runs if(from != address(0) && prevOwner == address(0)) prevOwner = to; else require(to != prevOwner, "Order TransferFromMiddleware");. The first transferFrom above the threshold therefore records its recipient as prevOwner and passes.
3. Every later transferFrom above the threshold whose recipient is prevOwner reverts. A swap sell above the threshold sends tokens to the pair, so if the pair is the stored recipient it is blocked. The source does not say which address that is. Transfers at or below the threshold skip the check entirely.
4. transfer uses transferMiddleware(recipient, trustedOwner): if(handler) require(to != prevOwner, "Handling Request");, so direct transfers to prevOwner also revert while trustedOwner is true.
5. The owner can move the goalposts: setSecureTransfer(uint256 _seed) sets securityLvl = _seed * 10**9; and setTrustedOwner(bool) flips the flag. It can also call forceLiquiditySync(uint256 _amount), which adds _amount to the caller's balance and to _totalSupply, and adjustBrand to change the name and symbol. A source comment in the onlyOwner modifier reads "fly, you fool. This is a scam."
6. What is documented: only the De.Fi listing. No transaction was opened here showing blocked sells or use of these functions.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract TKEN

Evidence

• address BscScan verified source, SafeMore_build03 0x15e92d6d0c95aba5c7266686303b2f08ddd06550 bscscan.com
• analysis De.Fi REKT database listing (proof link Token Sniffer, 403) tokensniffer.com
• analysis Sourcify match, SafeMore_build03.sol repo.sourcify.dev