Yield Goku Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Yield Goku Token (t.me/YieldGoku) is a token on BNB Smart Chain at 0xfbce1817…42b348, deployed in transaction 0x860a030b…595186. De.Fi's REKT database lists it as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling. In the verified source, transferFrom requires allow[_from] == true, a per-address flag that only the deployer has at construction and that a hard-coded privileged address can change with addAllow.

transfer has no such check. A comment in the source says 2% of each transaction is burned and 3% distributed to holders; the code contains no burn or distribution logic. The sources opened do not include a transaction showing holders being blocked.

How it happened

  1. The constructor sets allow[msg.sender] = true; for the deployer only and gives the deployer the whole supply (balances[msg.sender] = totalSupply;). Every other address starts with allow false.
  2. transferFrom contains require(allow[_from] == true);. Tokens moved on a holder's behalf through an allowance, which is how a DEX router pulls tokens from a seller, revert for any holder whose flag is false. The holder's balance is only debited after that check, so a reverted sale leaves the tokens in place.
  3. transfer has no allow check, so wallet-to-wallet transfers and transfers sent by a pool contract are not affected by this flag.
  4. addAllow(address holder, bool allowApprove) external onlyOwner sets allow[holder] to any value, so the privileged address can exempt chosen addresses from the block or remove an exemption.
  5. onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)). That decimal literal converts to 0xbd486897…439192, which differs from the deployer 0xEEA5d7F7…D5C5F1. The modifier never reads the owner variable, so transferOwnership does not change who can call addAllow or mint.
  6. mint(address miner, uint256 _value) external onlyOwner runs balances[miner] = _value;. It overwrites the recorded balance of any address with any value and does not touch totalSupply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract t.me/YieldGoku

Evidence

Same attack technique

Browse all hacks →
Ethereum Uniswap-V3 Loss not disclosed BNB Chain Dextrarius Token Loss not disclosed BNB Chain Hoe Coin BSC Loss not disclosed BNB Chain LamboPUMP Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes