Trump Swap Honeypot

What happened

TrumpSwap (TrumpSwap.org) was an Ethereum token deployed on 24 October 2020 by 0xD89B815B…59B6C1. The code has no switch that turns transfers off. Instead, burnFrom lets the owner move any holder's tokens into the owner's own balance without the holder's approval, so buyers can be emptied before they sell.

The deployer paired the whole 30,000-token supply with 100 ETH on Uniswap, called burnFrom 11 times while buyers were sending token approvals, and removed the liquidity two hours later for 101.94 ETH and 29,433 tokens. De.Fi's REKT database lists the loss as $795.

How it happened

1. The constructor credits all 30,000 tokens to the deployer and makes it the permanent owner: owner = msg.sender; balances[owner] = totalSupply;. No function changes owner.
2. Despite its name, burnFrom burns nothing. It moves tokens from any address to the owner with no allowance check: require(msg.sender == owner); balances[from] = balances[from].sub(numTokens); balances[owner] = balances[owner].add(numTokens);. It emits no Transfer event, so wallets see a balance drop with no matching transfer.
3. At 20:28:53 UTC the deployer added 30,000 tokens and 100 ETH to the Uniswap V2 pair with addLiquidityETH (transaction 0xa6352c88…4dc044).
4. Between 20:32 and 21:21 UTC the deployer called burnFrom 11 times, often in the same block as a buyer's approve. For example, transaction 0x36e5a5db…5da859 took 58 tokens from 0xb7ea1f23…63ba94 in the block where that address approved.
5. At 22:18:44 UTC the deployer withdrew the pool with removeLiquidityETHWithPermit, receiving 101.9374 ETH and 29,433.23 tokens (transaction 0xcff98fc4…dda048).

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract TrumpSwap

Protocol links Website

Evidence

• report Report trumpswap.org
• transaction TrumpSwap addLiquidityETH transaction etherscan.io
• transaction TrumpSwap token contract transaction list etherscan.io
• transaction TrumpSwap burnFrom transaction etherscan.io
• transaction TrumpSwap removeLiquidityETHWithPermit transaction etherscan.io
• address TrumpSwap verified source code etherscan.io
• analysis Sourcify match for 0xd305b0221da982c011fad8adf2ece0bdf790a427 on Ethereum repo.sourcify.dev