Voltage Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Voltage's transferFrom requires allow[_from] == true, and the only address that gets that flag in the constructor is the deployer. A holder who buys the token has allow unset, so a sale that pulls tokens with transferFrom reverts, while plain transfer has no such check. The contract also exposes addAllow and mint, both restricted to a hard-coded address, that can switch the flag for any holder and overwrite any balance.

De.Fi's REKT database lists Voltage (VOLTG) as an exit scam/honeypot on BNB Chain dated 2021-04-07 and describes the owner as able to disable transfers so users could not sell.

How it happened

  1. The constructor sets balances[msg.sender] = totalSupply; and allow[msg.sender] = true;, so only the deployer is flagged as allowed.
  2. transferFrom contains require(allow[_from] == true);. Every other address has allow false by default, so any transferFrom that moves their tokens reverts. A router sale pulls the seller's tokens with transferFrom.
  3. transfer has only require(_to != address(0)); and require(balances[msg.sender] >= _value);, with no allow check, so direct wallet-to-wallet moves still work.
  4. addAllow(address holder, bool allowApprove) is onlyOwner and can set the flag for any address, in either direction.
  5. mint(address miner, uint256 _value) is onlyOwner and runs balances[miner] = _value;, which overwrites the balance of any address without touching totalSupply.
  6. onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), a hard-coded address equal to 0xbd486897…439192. It differs from the deployer 0x5925aC8B…91F9aA, and the owner variable set in the constructor is not what onlyOwner checks.
  7. What the code allows is separate from what happened: no transaction was opened showing addAllow or mint being called. De.Fi's REKT database lists the token as an exit scam/honeypot.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract VOLTG

Evidence

Same attack technique

Browse all hacks →
BNB Chain Alpha Andromedae Loss not disclosed BNB Chain Dark.Build Loss not disclosed BNB Chain Setting Sun Loss not disclosed BNB Chain FairPluto Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes