Zona Indonesia Honeypot

What happened

Zona Indonesia (IDZ) is a BEP-20 token deployed on BNB Chain on 28 March 2021 at 0xb5756e1b…1d04d7. Every transfer runs through calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" when the recipient is flagged in PanCakeSwapReciever. The owner can flag any address, including the PancakeSwap pool, with setPanCakeSwapReciever, so once the pool is flagged tokens can still be bought out of it but no one can send tokens back in to sell.

De.Fi's REKT database lists IDZ as an exit scam/honeypot, saying the owner could disable transfers so holders could not sell.

How it happened

1. The constructor mints the whole supply to the deployer through _transferTO(msg.sender, 1000000000000000000e18) and Ownable makes the deployer the owner.
2. setPanCakeSwapReciever(address _recipient, bool _feeless) is onlyOwner and, unlike the fee-whitelist setters, is not limited by canWhitelist, so the owner can switch the flag on or off for any address at any time.
3. _transfer calls calculateFeesBeforeSend on every transfer. If PanCakeSwapReciever[recipient] is true, it reverts with "Error: Can not sell this token".
4. A PancakeSwap sale moves tokens from the seller to the pool, so with the pool flagged every sale reverts, while buys, which move tokens out of the pool, still succeed. The check does not exempt the owner either, so the pool would have to be flagged after liquidity is added.
5. The declared fee is a decoy: seTxFee is capped at 100 but calculateFeesBeforeSend always returns (amount, 0), so txFee is never charged.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract IDZ

Evidence

• report Token Sniffer post cited as proof by De.Fi twitter.com
• transaction IDZ contract creation transaction bscscan.com
• address INDONESIA (Zona Indonesia, IDZ) verified source code bscscan.com
• analysis Sourcify match for 0xb5756e1b11c045b2f727c7d2b33aa813f41d04d7 on BNB Chain repo.sourcify.dev