Windswap Honeypot
What happened
De.Fi's REKT database lists Windswap (WINDY), contract 0xdabb7e8a…12faf6 on BNB Smart Chain, as an exit scam/honeypot and notes that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows how: _transfer reverts for any sender other than the owner or a stored pancake address while an owner-switchable flag TIME is true, so an ordinary holder's sale reverts. The revert text mentions one sale per 30 minutes, but the code contains no timer; the condition fails every such transfer until the owner calls setTIME(false).
How it happened
What the code allows:
- The deployer receives the whole supply in the constructor:
_mint(msg.sender, 1000000000000000e18);. - The gate is on from deployment:
bool private TIME = true;. - Every transfer runs this check:
if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. A holder who is not the owner, sending to anyone other than the owner, reverts unless the holder's address equalspancake. pancakeis not fixed.if(sender == owner()){ pancake = recipient; }overwrites it with the recipient of every transfer the owner sends, andaddPancake(address input)lets the owner set it directly. Only the one stored address (plus the owner) can send tokens whileTIMEis true.- The owner alone controls the gate:
function setTIME (bool _bool) public onlyOwner { TIME = _bool; }.transDatarecords a timestamp for sells but nothing reads it, so the 30-minute wording has no effect on the revert. - Two further owner switches can block individual senders or large sales:
GTYA(address _addr, bool _bool)marks abotsender whose transfers hitrequire(amount <=0, "bots......"), andfire(uint256 TKP)sets theMAXcap applied to transfers into addresses flagged byPOOL.
De.Fi's REKT database lists the token as an exit scam/honeypot where the owner could disable transfers. No transaction showing the owner calling these functions was opened.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.