VOLCANOS Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

VOLCANOS (BIT VOLCANO) is a BNB Chain token deployed on 10 June 2021 at 0xff0788d9…c4dcd1 by 0x55c1E784…61003F. The deployer holds a hidden owner role and can switch on a tracing flag. While it is on, the first transferFrom records its recipient as nxOwner, and every later transfer to that address reverts; when that recipient is the PancakeSwap pair, holders can buy but cannot sell.

The public currentOwner reads as the zero address, but renounceOwnership only changes that display variable and anyone can call it. The owner can also credit itself unlimited tokens through emitTransfer. De.Fi's REKT database lists VOLCANOS as a honeypot; no loss figure is recorded.

How it happened

  1. The constructor sets the deployer as the internal owner, credits it with 10 trillion BIT VOLCANO (9 decimals), sends half to the 0x...dEaD address, and sets the public currentOwner to the zero address.
  2. renounceOwnership(address _newOwner) has no access check and only writes currentOwner = _newOwner;. The real permission check is require(msg.sender == owner || msg.sender == nxOwner);, which it never touches.
  3. The owner can call setTracing(true). With tracing on, transferFrom runs if(from != address(0) && nxOwner == address(0)) nxOwner = to;, so the next transferFrom recipient is stored, normally the pair when liquidity is added through the router.
  4. From then on, transferFrom and transfer revert when the recipient is nxOwner ("Order ContextHandler" or "Handling Request"). A PancakeSwap sale moves tokens from the seller to the pair with transferFrom, so it fails, while buys (pair to buyer through transfer) still work.
  5. emitTransfer(uint256) lets the owner add any amount to its own balance without changing the total supply, and setTracing(false) lets it lift the block whenever it chooses.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BIT VOLCANO

Evidence

Same attack technique

Browse all hacks →
BNB Chain OCTOPIX Loss not disclosed BNB Chain RASIM OZAN Loss not disclosed Ethereum Croco Inu Loss not disclosed Ethereum ghostshiba.xyz Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes