ZirgonYield Honeypot

What happened

De.Fi's REKT database lists ZirgonYield (ZYIELD) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. In the verified source, the fee-calculation helper reverts any transfer whose recipient the owner has flagged with setPanCakeSwapReciever, with the message "Error: Can not sell this token". Because both transfer and transferFrom pass through it, flagging a pair address makes every sale into that pair revert while transfers to other addresses continue to work.

How it happened

1. The deployer becomes owner (_owner = _msgSender();) and the constructor mints the whole supply to it: _transferTO(msg.sender, 1000000000e18);.
2. The owner can mark any address as a restricted recipient: function setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner { ... PanCakeSwapReciever[_recipient] = _feeless; }. Unlike the fee whitelist setters, it is not limited by canWhitelist, so renounceWhitelist() does not lock it.
3. Every transfer runs _transfer, which first debits the sender (_balances[sender] = _balances[sender].sub(amount, ...)) and then calls calculateFeesBeforeSend(sender, recipient, amount).
4. That function reverts for flagged recipients: if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The revert undoes the whole transaction, so the holder's balance is unchanged and the sale fails. For unflagged recipients it returns (amount, 0), so the full amount is credited and no fee is taken.
5. A swap that sells into a pair sends the holder's tokens to the pair address, so if the owner flags that address the sale reverts. Setting the flag back to false re-enables transfers to it, so the owner can switch the restriction on and off. The source does not say which address is the pair.
6. Separately, _transfer requires amount > 1000, and the owner can call renounceOwnership(), which would remove setPanCakeSwapReciever. The on-chain owner() read at the latest block on 2026-09-30 is still the deployer, so ownership was not renounced as of that read.
7. What the code allows: the owner can block sales to any address it flags. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction showing the owner flagging a pair address was opened.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ZYIELD

Evidence

• report De.Fi REKT database listing (via proof link) twitter.com
• address ZirgonYield verified source on BscScan bscscan.com
• analysis ZirgonYield on Sourcify repo.sourcify.dev