Uga Uga Honeypot

What happened

Uga Uga (UGA) is a BNB Smart Chain token at 0x385aebaf…07ab64 whose _approve function only honours approvals from one hard-coded address, 0xcF80096E…2f2Be5, which is also the deployer and current owner. For every other holder the allowance is stored as 0, so a DEX router cannot pull their tokens with transferFrom and a sell reverts, while buying and plain wallet-to-wallet transfers still work. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply;.
2. approve calls _approve(_msgSender(), spender, amount), and _approve branches on the hard-coded address: if (owner == address(0xcF80096EA48db7354c9e83578a6c56E88E2f2Be5)) { the amount is stored; } else { the code runs _allowances[owner][spender] = 0; and emits Approval(owner, spender, 0). A holder's approve call therefore succeeds without reverting but records nothing.
3. A DEX sell needs the router to call transferFrom(holder, pair, amount). That function runs _transfer and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). The stored allowance is 0, so sub reverts for any amount above 0 and the whole call, including the transfer, is undone.
4. Buys are unaffected: the pair sends tokens with a plain transfer, which only runs _transfer. The hard-coded address passes step 2, so its own approvals work.
5. The exemption is tied to the address, not to owner(), so renounceOwnership or transferOwnership would not remove it. Separately, mint(uint256 amount) is onlyOwner and credits the owner, so the owner can also create new supply.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract UGA

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, Uga Uga bscscan.com
• analysis Sourcify match, chain 56, 0x385aebaf4af8a7cdd722db7c9e438d4f0d07ab64 repo.sourcify.dev
• analysis Scam explained: BSC noapproval cryptot3ddybear.gitlab.io
• analysis De.Fi REKT database listing for UGA (imported listing fields in meta.json) de.fi