Ursa Major Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Ursa Major (URSA) is a BNB Chain token deployed on 20 April 2021 at 0xb486d4c4…13360b by 0x4930Ed93…8dEa54, which still holds ownership. Its _approve function stores the requested allowance only when the approving wallet is that hard-coded deployer address; for every other holder it stores 0 while emitting an Approval event with the value 2. A PancakeSwap sale pulls tokens with transferFrom, which subtracts the sale amount from that zero allowance and reverts, so ordinary holders can buy URSA but cannot sell it through the router, while the deployer can still add liquidity and sell.

The owner can also create new supply with mint. De.Fi's REKT database lists Ursa Major as an exit scam/honeypot and describes it as the owner disabling transfers, but the code contains no transfer switch.

How it happened

  1. The constructor hard-codes _name = "Ursa Major" and _symbol = "URSA" and credits all 12500000000000000 raw units (125,000,000 URSA at 8 decimals) to the deployer, who also becomes owner().
  2. Every allowance write goes through _approve. If owner == address(0x4930Ed9333e8e16084F0E3ee656C4c51518dEa54) the requested amount is stored; otherwise _allowances[owner][spender] = 0 and the event reports Approval(owner, spender, 2). approve, increaseAllowance and decreaseAllowance all end in this function, so a holder's wallet shows an approval succeeding while the stored allowance stays 0.
  3. Buying works because the PancakeSwap pair sends tokens out with plain transfer, which has no allowance check.
  4. Selling through the router calls transferFrom(holder, pair, amount). _transfer moves the tokens, then _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance") underflows against the zero allowance and the whole transaction reverts.
  5. The hard-coded wallet keeps real allowances, so it can add liquidity and sell through the router. The exemption is tied to that literal address, not to owner(), so renounceOwnership would not remove it.
  6. mint(uint256 amount) is onlyOwner and credits new tokens to the caller with no cap. The total supply read on 2026-09-30 equals the constructor amount, so no net minting shows in the current state.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract URSA

Evidence

Same attack technique

Browse all hacks →
BNB Chain TESLAFARM.FINANCE Loss not disclosed BNB Chain MarsStop Loss not disclosed Ethereum ChowChow Token Loss not disclosed BNB Chain Kleeka Inu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes