Zevia Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Zevia (ZEVIA) is a BNB Smart Chain token whose verified source lets the owner switch on a sell penalty that takes almost the whole amount of any sale into the liquidity pair. The fee is off at deployment, but setFeeEnabled is owner-only, has no cap and can be flipped at any time, while the owner, the router and the token contract are exempt. De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-04-26 and says the contract owner could disable the transfer function, which restricted users in selling their tokens; the verified code contains no function that disables transfers, and the sell restriction it does contain is this fee switch.

How it happened

  1. The constructor sets _owner = msg.sender and _balances[_owner] = _totalSupply;, so the deployer holds the whole supply (100000000 * 10**9, 9 decimals). It also creates the pair with .createPair(address(this), uniswapV2Router.WETH()) on the router at 0x10ED43C7…56024E.
  2. bool public _feeEnabled = false; means ordinary transfers and sells work at first. Only the owner can change it: function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }.
  3. Once enabled, _transfer applies the fee to any transfer where to == uniswapV2Pair and from is not the router, the owner or the token contract. A holder selling through the router is the from address in transferFrom, so the holder is the one penalised.
  4. The fee is uint256 fee = mul(div(amount, 100), 100);, which is amount rounded down to a multiple of 100, so the fee equals the whole amount except the remainder (at most 99 base units). The seller is debited the full amount first (_balances[from] = sub(_balances[from], amount);), the pair is credited only sub(amount, fee), and the fee is subtracted from _totalSupply instead of being paid to anyone.
  5. Buys (from is the pair) and any transfer by the owner skip this branch, so the owner can sell while holders cannot.
  6. The owner can switch the fee off again with the same function. The contract has no ownership-transfer or renounce function, and _owner is only assigned in the constructor.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ZEVIA

Evidence

Same attack technique

Browse all hacks →
BNB Chain Flare Loss not disclosed BNB Chain LunarLaunchProject Loss not disclosed BNB Chain BitLink Loss not disclosed BNB Chain NftFinal Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes