XenonFinance Honeypot

What happened

De.Fi's REKT database lists XenonFinance (XENON) on BNB Smart Chain as an Exit Scam/Honeypot and describes the contract owner as able to disable the transfer function, which restricted users from selling. The verified source for 0x1874a5e0…aa8db5 has an owner-only setFeeEnabled switch. While it is on, any non-exempt transfer to the liquidity pair takes a fee computed as mul(div(amount, 100), 100), which is the whole amount rounded down to a multiple of 100 base units.

The pair receives at most 99 base units of a sell, while the seller's balance is debited the full amount.

How it happened

1. The constructor mints 100,000,000 tokens with 9 decimals to the deployer (_totalSupply = 100000000 * 10**9;, _balances[_owner] = _totalSupply;) and creates a pair for the token against the router's WETH(). _feeEnabled starts as false.
2. Only the owner can switch the fee on or off: function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }. There is no cap and no other limit on it, and the source has no function to transfer or renounce ownership.
3. _transfer first debits the sender in full: _balances[from] = sub(_balances[from], amount);.
4. When _feeEnabled && to == uniswapV2Pair && from != address(uniswapV2Router) && from != _owner && from != address(this), it sets uint256 fee = mul(div(amount, 100), 100);. div(amount, 100) truncates and mul(..., 100) scales it back, so fee equals the amount except for a remainder of 0 to 99 base units.
5. The pair is credited only sub(amount, fee), and the fee is removed from supply with _totalSupply = sub(_totalSupply, fee);. A holder selling into the pair while the fee is on therefore gives up essentially the entire amount. A sale made through the router would normally have from equal to the seller, who is not exempt.
6. Buys, where to is not the pair, and any transfer by the owner are not affected. Whether the owner ever called setFeeEnabled(true) is not shown by the code.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract XENON

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source code, XenonFinance 0x1874a5e0fff1392a750094cca3950fd52baa8db5 bscscan.com
• analysis Sourcify repository entry for the same contract repo.sourcify.dev