WARONRUGS Honeypot
What happened
WARONRUGS (WOR) is a BNB Chain token with an owner-controlled sell block. The owner can call setPanCakeSwapReciever to flag any address, and calculateFeesBeforeSend, which _transfer runs on every transfer, then reverts with "Error: Can not sell this token" for any transfer whose recipient is flagged. If the flagged address is the trading pair, a DEX sell reverts for every holder.
The token's fee machinery is inert: txFee is 0 and calculateFeesBeforeSend returns (amount, 0). De.Fi's REKT database lists WOR as an Exit Scam/Honeypot in which the owner could restrict users from selling.
How it happened
- The constructor mints 1,000,000 tokens (
_transferTO(msg.sender, 1000000e18)) to the deployer, who becomes the owner. setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwnersetsPanCakeSwapReciever[_recipient]for any non-zero address. The code does not show which address, if any, the owner flagged.- Every
transferandtransferFromgoes through_transfer, which callscalculateFeesBeforeSend(sender, recipient, amount). That function starts withif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer to a flagged recipient reverts, whoever the sender is. - A DEX sell sends the holder's tokens to the pair, so if the pair is flagged the sell reverts. Buying, which sends tokens out of the pair, is not affected.
- The flag can be turned off again by the owner with
setPanCakeSwapReciever(_recipient, false).renounceOwnershipexists and would end that control, but the code does not show whether it was called.renounceWhitelistonly disables the fee whitelist setters and does not affect this flag.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.