Windswap Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists Windswap (WINDY), contract 0xdabb7e8a…12faf6 on BNB Smart Chain, as an exit scam/honeypot and notes that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows how: _transfer reverts for any sender other than the owner or a stored pancake address while an owner-switchable flag TIME is true, so an ordinary holder's sale reverts. The revert text mentions one sale per 30 minutes, but the code contains no timer; the condition fails every such transfer until the owner calls setTIME(false).

How it happened

What the code allows:

  1. The deployer receives the whole supply in the constructor: _mint(msg.sender, 1000000000000000e18);.
  2. The gate is on from deployment: bool private TIME = true;.
  3. Every transfer runs this check: if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. A holder who is not the owner, sending to anyone other than the owner, reverts unless the holder's address equals pancake.
  4. pancake is not fixed. if(sender == owner()){ pancake = recipient; } overwrites it with the recipient of every transfer the owner sends, and addPancake(address input) lets the owner set it directly. Only the one stored address (plus the owner) can send tokens while TIME is true.
  5. The owner alone controls the gate: function setTIME (bool _bool) public onlyOwner { TIME = _bool; }. transData records a timestamp for sells but nothing reads it, so the 30-minute wording has no effect on the revert.
  6. Two further owner switches can block individual senders or large sales: GTYA(address _addr, bool _bool) marks a bot sender whose transfers hit require(amount <=0, "bots......"), and fire(uint256 TKP) sets the MAX cap applied to transfers into addresses flagged by POOL.

De.Fi's REKT database lists the token as an exit scam/honeypot where the owner could disable transfers. No transaction showing the owner calling these functions was opened.

Protocol details

Classification Token / Exchange (DEX)
Protocol Type Exit Scam/Honeypot
Affected asset / contract WINDY

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.