VibeSwap Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

VibeSwap (Vibe) is a BEP-20 token on BNB Chain at 0x4c04c78f…42ec7a, deployed on 28 February 2021 by 0x758f2244…F764FF, which received all 4,200,000 Vibe and is still the owner. The owner can mark any address with setPanCakeSwapReciever, and every transfer to a marked address reverts with "Error: Can not sell this token". Marking the PancakeSwap pair stops all sales while buys still work, because tokens leaving the pair are not checked.

Unlike the fee whitelist, this list is not closed by renounceWhitelist. De.Fi's REKT database lists Vibe as an exit scam/honeypot and says the owner could disable transfers so that users could not sell.

How it happened

  1. The constructor credits all 4,200,000 Vibe to the deployer, who is owner.
  2. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and sets PanCakeSwapReciever[_recipient] for any address, with no lock or renounce switch.
  3. Every transfer and transferFrom runs _transfer, which calls calculateFeesBeforeSend; that function reverts with "Error: Can not sell this token" when the recipient is flagged.
  4. A sale on PancakeSwap sends Vibe to the pair, so once the owner flags the pair, every holder's sell reverts, while buys (tokens sent from the pair) still succeed.
  5. The flag also blocks the owner's own sales, but the owner can clear it, sell, and set it again; ownership moves only through a two-step transferOwnership and recieveOwnership, or ends with renounceOwnership.
  6. De.Fi's REKT database lists Vibe as an exit scam/honeypot in which users could not sell; no transaction flagging the pair was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Vibe

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.