Yolo Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Yolo Token (Yolo) is a BNB Chain token deployed on 24 April 2021 at 0x5bf5f899…c7c57d by 0xd78c00cC…DB355C. Its transferFrom requires allow[_from] == true, and the constructor sets that flag only for the deployer, so every other holder's sale through the PancakeSwap router reverts while buys, which use plain transfer, go through. The onlyOwner modifier does not check the stored owner; it checks a hard-coded address written as a decimal number, 0xbd486897…439192.

That address alone can add wallets to the allow list with addAllow and can overwrite any account's balance with mint, and there is no function to give up that power. The header comment advertises a 10% tax with holder rewards and burns, but the code contains no fee logic. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor gives the whole supply (1 YOLO at 18 decimals) to the deployer and runs allow[msg.sender] = true;, so the deployer is the only address on the allow list.
  2. transferFrom checks require(allow[_from] == true);. The router pulls tokens with transferFrom for both adding liquidity and selling, so the deployer can add liquidity but a holder's sale reverts.
  3. Buys from the pair use transfer, which only checks the recipient and the sender's balance, so anyone can buy.
  4. onlyOwner is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which is 0xbd486897…439192. Only that address can call addAllow(holder, allowApprove) to let chosen wallets sell, and transferOwnership changes the unused owner variable without changing who passes the check.
  5. The same address can call mint(miner, _value), which runs balances[miner] = _value;, setting any account's balance to any number without touching totalSupply.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Yolo

Evidence

Same attack technique

Browse all hacks →
Ethereum DEXTrust.Finance Loss not disclosed Ethereum World Of Warcraft Loss not disclosed BNB Chain Bull Loss not disclosed BNB Chain SHIBA PROTOCOL Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes