Virax Coin Honeypot

What happened

Virax Coin (VIRAX) is a BEP-20-style token on BNB Smart Chain whose transfer path contains an owner-controlled recipient blocklist. setPanCakeSwapReciever lets the owner flag any address, and calculateFeesBeforeSend reverts every transfer whose recipient is flagged with "Error: Can not sell this token". No address is flagged by default, and the verified code does not show which addresses, if any, were flagged.

De.Fi's REKT database lists the token as an exit scam/honeypot in which the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor mints the whole supply to the deployer: _transferTO(msg.sender, 10000e18); (10,000 VIRAX at 18 decimals). The deployer is also the initial owner through Ownable.
2. The owner can call setPanCakeSwapReciever(address _recipient, bool _feeless), which does PanCakeSwapReciever[_recipient] = _feeless;. The function accepts any non-zero address and has no canWhitelist check, so renounceWhitelist does not disable it.
3. Every transfer goes through _transfer, which subtracts the sender balance and then calls calculateFeesBeforeSend(sender, recipient, amount).
4. If the recipient is flagged, calculateFeesBeforeSend runs revert("Error: Can not sell this token");. The revert undoes the whole call including the earlier balance subtraction, so the holder keeps the tokens but cannot send them to that address.
5. For any recipient that is not flagged the function returns (amount, 0), so ordinary transfers succeed. A sell becomes impossible only if the address receiving the tokens in that sale has been flagged by the owner. Ownership can be handed over or given up through transferOwnership and renounceOwnership; the owner read from the chain on 2026-09-30 was the deployer address 0x0619b748…2af14c.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract VIRAX

Evidence

• report @Token_Sniffer incident report twitter.com
• address Virax Coin verified source on BscScan bscscan.com
• analysis Virax Coin on Sourcify (exact match) repo.sourcify.dev