WARONRUGS Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

WARONRUGS (WOR) is a BNB Chain token with an owner-controlled sell block. The owner can call setPanCakeSwapReciever to flag any address, and calculateFeesBeforeSend, which _transfer runs on every transfer, then reverts with "Error: Can not sell this token" for any transfer whose recipient is flagged. If the flagged address is the trading pair, a DEX sell reverts for every holder.

The token's fee machinery is inert: txFee is 0 and calculateFeesBeforeSend returns (amount, 0). De.Fi's REKT database lists WOR as an Exit Scam/Honeypot in which the owner could restrict users from selling.

How it happened

  1. The constructor mints 1,000,000 tokens (_transferTO(msg.sender, 1000000e18)) to the deployer, who becomes the owner.
  2. setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner sets PanCakeSwapReciever[_recipient] for any non-zero address. The code does not show which address, if any, the owner flagged.
  3. Every transfer and transferFrom goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount). That function starts with if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer to a flagged recipient reverts, whoever the sender is.
  4. A DEX sell sends the holder's tokens to the pair, so if the pair is flagged the sell reverts. Buying, which sends tokens out of the pair, is not affected.
  5. The flag can be turned off again by the owner with setPanCakeSwapReciever(_recipient, false). renounceOwnership exists and would end that control, but the code does not show whether it was called. renounceWhitelist only disables the fee whitelist setters and does not affect this flag.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WOR

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.