WOODEN Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

WOODEN Token (WOOD) is a BNB Smart Chain token whose _transfer reverts for most senders while an owner-controlled flag, TIME, is true. The flag starts as true, and only the owner can switch it with setTIME. The revert text talks about one sale per 30 minutes, but the time comparison is commented out, so no timer exists.

A holder who is not the owner and not the address stored in pancake is refused when sending to any recipient other than the owner, including a liquidity pair; sends to the owner are not blocked. De.Fi's REKT database lists the token as an exit scam/honeypot and says the owner could disable the transfer function.

How it happened

  1. The constructor mints the whole supply (_mint(msg.sender, 1000000000000000e18), 1,000,000,000,000,000 tokens) to the deployer, who is also the Ownable owner, and TIME is declared as bool private TIME = true;.
  2. Whenever the owner is the sender, _transfer stores the recipient in pancake (if(sender == owner()){ pancake = recipient; }). If the owner sends tokens into a liquidity pair, that pair becomes the one address allowed to send. The owner can also set it directly with addPancake.
  3. Other transfers hit if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. A holder selling through a router sends from their own address to the pair, so the call reverts. Wallet-to-wallet transfers revert the same way. Transfers sent by the owner or by the pancake address, which covers buys from a pair stored there, and transfers whose recipient is the owner are not caught by this check.
  4. The message mentions a 30-minute limit, but the time term in the condition is commented out (//&& timeNow < transData[sender] + 10 minutes). The revert fires on TIME == true alone.
  5. The owner can switch the block with setTIME(bool). Further owner-only controls can also stop sells: fire sets the cap MAX, POOL marks recipients that are checked against MAX, GTYA flags a sender as a bot so require(amount <=0, "bots......") always reverts, and setFee can charge up to 10% (_newTxFee <= 100 over a 1000 divisor).
  6. A read of owner() on 2026-09-30 returned the deployer address 0x19b9fb92…c0425f, so the owner-only functions were still callable at that read. That is the current state only. No transaction was opened that shows who called setTIME or that sells failed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WOOD

Evidence

Same attack technique

Browse all hacks →
BNB Chain WhereLambo Loss not disclosed BNB Chain NEPTUNE Token Loss not disclosed BNB Chain GEMROCKET Loss not disclosed BNB Chain HuskyMoon Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes