YES Token Honeypot

What happened

YES Token (YES) is a BNB Smart Chain token at 0x7a5ce1f2…0a3b9e whose _approve function only honours approvals from one hard-coded address, 0x192Cf151…fB5774, which is also the deployer and current owner. For every other holder the allowance is stored as 0, so a DEX router cannot pull their tokens with transferFrom and a sell reverts, while buying and plain wallet-to-wallet transfers still work. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply;.
2. approve calls _approve(_msgSender(), spender, amount), and _approve branches on the hard-coded address: if (owner == address(0x192Cf151860787746A5675779f28c42300fB5774)) { the amount is stored; } else { the code runs _allowances[owner][spender] = 0; and emits Approval(owner, spender, 0). A holder's approve call therefore succeeds without reverting but records nothing.
3. A DEX sell needs the router to call transferFrom(holder, pair, amount). That function runs _transfer and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). The stored allowance is 0, so sub reverts for any amount above 0 and the whole call, including the transfer, is undone.
4. Buys are unaffected: the pair sends tokens with a plain transfer, which only runs _transfer. The hard-coded address passes step 2, so its own approvals work.
5. The exemption is tied to the address, not to owner(), so renounceOwnership or transferOwnership would not remove it. Separately, mint(uint256 amount) is onlyOwner and credits the owner, so the owner can also create new supply.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract YES

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, YES Token bscscan.com
• analysis Sourcify match, chain 56, 0x7a5ce1f2754f83e294eb501274f08e9d730a3b9e repo.sourcify.dev
• analysis Scam explained: BSC noapproval cryptot3ddybear.gitlab.io
• analysis De.Fi REKT database listing for YES (imported listing fields in meta.json) de.fi