<h2 id="header-0">Background</h2><p>Recently, X user &#64;roffett_eth tweeted about the presence of many ERC20 honeypot tokens on the GMGN website’s trending list. Even though these tokens are labeled as “Everything is SAFU,” caution is still advised. As scammers may not have completed the entire rug pull process. SlowMist founder Cos noted that this issue is not limited to GMGN — it also appears on platforms like DEXTools and DEX Screener. This article aims to analyze common deceptive tactics used in honeypot tokens, outline their characteristics, and equip users, even those without technical expertise, with the knowledge to recognize such tokens and protect their funds.</p><p><img src="https://miro.medium.com/v2/resize:fit:598/0*_SLxa8B3qVKZ2bhz" /></p><p>(https://x.com/evilcos/status/1838874085641859321)</p><h2 id="header-1">Risks of HoneyPot Tokens</h2><p>In our previous article, <a href="https://slowmist.medium.com/beginners-guide-to-web3-security-avoiding-honeypot-scams-edae476da896" rel="noopener noreferrer nofollow">Introduction to Web3 Security | HoneyPot Token Scams</a>, we explained why users often fall victim to honeypot scams and outlined common strategies used by scammers. Today, we’ll delve into specific examples of honeypot scams to examine the methods used by malicious actors.</p><p>One common feature in the crypto space is the <strong>Burn</strong> function, a legitimate operation intended to permanently destroy tokens, thereby reducing the circulating supply. However, in honeypot token scams, malicious developers use privileged addresses to invoke the Burn function in a way that allows them to destroy tokens from users’ wallets without their consent, effectively stealing the tokens. This method not only decreases the token balance of affected users but also allows scammers to manipulate the market price or control the token’s circulation by exploiting other contract vulnerabilities. A classic example of this is the Xiaopang token (6JCQ8Bsx8LcmE8FVsMrDVhXJ9hJYaykTXsoVN67CLsSX) on the Solana blockchain.</p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*aXYSqh2SecM7Jw0-" /></p><p><a href="https://solscan.io/token/6JCQ8Bsx8LcmE8FVsMrDVhXJ9hJYaykTXsoVN67CLsSX" rel="noopener noreferrer nofollow">https://solscan.io/token/6JCQ8Bsx8LcmE8FVsMrDVhXJ9hJYaykTXsoVN67CLsSX</a></p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*sHqfBNT23TKZj-mw" /></p><p><a href="https://solscan.io/tx/FnHT9joQPGsap7T5e41h462m3tSKJ4NZPCVvF7Cd3Ucd3mP7U3D5UQxwqKPciR3YMrsDE8p4F4rMVcvi9x1WWVr" rel="noopener noreferrer nofollow">https://solscan.io/tx/FnHT9joQPGsap7T5e41h462m3tSKJ4NZPCVvF7Cd3Ucd3mP7U3D5UQxwqKPciR3YMrsDE8p4F4rMVcvi9x1WWVr</a></p><h3 id="analysis-of-the-bigi-dao-token-on-base">Analysis of the BIGI DAO Token on Base</h3><p>(0x8384De070d4417fDf1e28117f244E909C754bCFf)</p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*6zcVSBlp9a3NWOhC" /></p><p>Using a risk detection tool, the BIGI DAO token has been flagged as a honeypot token. Upon analyzing the contract code, we found that the token’s &#96;permit&#96; function, which is meant to verify user signatures, is designed to first check the address initiating the signature verification transaction. If this address matches a specific pre-configured address set by the scammers, the signature validation process can be bypassed entirely. In this scenario, malicious developers exploit a modified &#96;permit&#96; function to forcibly gain token approvals, enabling them to transfer users’ assets without permission.</p><p><strong>Code Example:</strong></p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/f691b2b5a130439db8045efebdaaa274.png" /><p>As the TON blockchain rapidly grows, it has also attracted numerous malicious developers setting up honeypot tokens, such as the JOPER token (EQDUQksb6Fa7w42hzP-HzUxiArWfK0Ck_HMPYuewW5Cd5_dv). However, due to the relatively new nature of the TON blockchain, there are limited tools available for detecting risks associated with its tokens. We found the JOPER token’s risk assessment results on OKX, where it is flagged as high-risk and suspected to be a honeypot token.</p><p><img src="https://miro.medium.com/v2/0*2fQaQSrqdQhzPFRy" /></p><p>Through our analysis of the token’s contract code, we identified that malicious developers can control the transfer permissions of token holders, and there is a mechanism for additional token issuance. For users without a technical background, AI tools can help assess the code for suspicious elements and potential risks. These tools can reveal hidden threats, here’s an example below when we asked Chatgpt : I<strong>f this code segment was written by a hacker, how could they exploit it?</strong></p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*3_Aou0GjFvBiyLOm" /></p><h2 id="header-2">How to Avoid Falling for HoneyPot Tokens</h2><p>Many new users tend to pick target tokens based on high trading volume rankings on platforms. Malicious developers take advantage of this by using multiple addresses to simulate trading activity and holdings, artificially boosting the rankings of honeypot tokens to attract unwary users. If users fail to conduct thorough due diligence, they may fall into these traps, resulting in financial losses. The SlowMist security team recommends the following precautions:</p><h3 id="1-enable-risk-filters-on-ranking-platforms">1. Enable Risk Filters on Ranking Platforms</h3><p>When viewing token rankings, users can enable risk filtering features to exclude tokens with high trading risks, such as honeypot tokens, from the lists.</p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*pBKiyNkySmpRMpL6" /></p><p>Note: While using these filters is essential, it is not foolproof. Detection tools cannot cover every potential risk, and as highlighted by tools like Honeypot, “a token that is not a honeypot now might become one later.” Therefore, users should remain vigilant even after filtering out risky tokens.</p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*OrKv1JVuMmzhNFsj" /></p><h3 id="2-use-platforms-with-risk-alerts">2. Use Platforms with Risk Alerts</h3><p>Some platforms provide warnings when a user attempts to trade high-risk tokens, such as honeypot tokens, and may even prevent the transaction altogether. This feature serves as a crucial last line of defense for protecting users’ funds. Users are advised to trade on platforms that offer such risk alerts, reducing the chance of falling victim to honeypot schemes.</p><p><img src="https://miro.medium.com/v2/resize:fit:700/0*3YzhKyvqhf_5K8M6" /></p><h3 id="3-review-risk-information">3. Review Risk Information</h3><p>Many trading platforms and risk monitoring tools provide detailed information on detected risks and the results of their assessments. Reviewing this information can significantly improve users’ ability to identify honeypot tokens. Key risk characteristics to watch out for include:</p><p>- Has Contract Ownership Been Renounced? Some token contracts may falsely claim to have renounced ownership while retaining the ability to modify the code, potentially turning the token into a honeypot.</p><p>- Does the Contract Include a Trading Pause Feature? This feature can allow scammers to freeze all token transactions.</p><p>- Is There Authority to Modify Transaction Fees? Excessively high transaction fees can prevent tokens from being traded normally.</p><p>- Does the Contract Have a Blacklist/Whitelist Mechanism? Malicious developers may use this to blacklist user addresses, preventing them from selling tokens, or whitelist their own addresses to offload tokens while others are unable to trade.</p><h3 id="4-stay-skeptical-and-always-verify">4. Stay Skeptical and Always Verify</h3><p>All of the above methods hinge on maintaining a healthy degree of skepticism and using multiple verification tools. Given that different risk detection tools vary in their methods, focus areas, and supported blockchain networks, and considering that malicious developers can remain undetected for varying lengths of time, users should consult multiple tools before trading. Here are some commonly used risk detection tools:</p><ul><li>Honeypot: <a href="https://honeypot.is/" rel="noopener noreferrer nofollow">https://honeypot.is/</a></li><li>Token Sniffer: <a href="https://tokensniffer.com/" rel="noopener noreferrer nofollow">https://tokensniffer.com/</a></li><li>OKX: <a href="https://www.okx.com/zh-hans/web3/dex-market" rel="noopener noreferrer nofollow">https://www.okx.com/zh-hans/web3/dex-market</a></li><li>GoPlus: <a href="https://gopluslabs.io/token-security" rel="noopener noreferrer nofollow">https://gopluslabs.io/token-security</a></li><li>De.Fi: <a href="https://de.fi/scanner" rel="noopener noreferrer nofollow">https://de.fi/scanner</a></li></ul><h3 id="about-slowmist">About SlowMist</h3><p>At SlowMist, we pride ourselves on being a frontrunner in blockchain security, dedicating years to mastering threat intelligence. Our expertise is grounded in providing comprehensive security audits and advanced anti-money laundering tracking to a diverse clientele. We’ve established a robust network for threat intelligence collaboration, positioning ourselves as a key player in the global blockchain security landscape. We offer tailor-made security solutions that span from identifying threats to implementing effective defense mechanisms. This holistic approach has garnered the trust of numerous leading and recognized projects worldwide, including names like Huobi, OKX, Binance, imToken, Crypto.com, Amber Group, Klaytn, EOS, 1inch, PancakeSwap, TUSD, Alpaca Finance, MultiChain, and Cheers UP. Our mission is to ensure the blockchain ecosystem is not only innovative but also secure and reliable.</p><p>We offers a variety of services that include but are not limited to security audits, threat intelligence, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) solutions, Vulpush (Vulnerability monitoring) , SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) , Safe Staking and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, FireEye, RC², TianJi Partners, IPIP, etc.</p><p>By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we wish to help spread awareness and raise the security standards in the blockchain ecosystem.</p><p><strong>&#x1f4ac;<a href="https://www.slowmist.com/" rel="noopener noreferrer nofollow">Website</a> &#x1f426;<a href="https://twitter.com/SlowMist_Team" rel="noopener noreferrer nofollow">Twitter </a>⌨️<a href="https://github.com/slowmist/" rel="noopener noreferrer nofollow">GitHub</a></strong></p>

SlowMist: Guide to Avoiding HoneyPot Scams

Table of Contents

SlowMist

Other articles published on Oct 15, 2024

Weekly Article Recap: 10/07-10/11

NYDFS chief’s advice for crypto firms: ‘Never surprise your regulator’

Do Kwon Allegedly Made Crypto Transactions From Prison Amid Legal Controversy

Coinbase presses U.S. Court to compel SEC to release crypto classification documents

Top Trending Cryptos on Solana Chain Today – MAGA HAT, Pepe of Freedom, JoyCat

First Neiro on Ethereum (NEIRO) Surges By Double Digits: More Rally Ahead?

Join our free newsletter for daily crypto updates!