Honeypot
Honeypot is a scam token that lets buyers purchase it but blocks or prevents them from selling, so the money paid in stays with the creator.[1] Unlike a Rug pull, in which creators abandon a token after taking its liquidity, a honeypot's price and balances can look normal while sales fail.[1]
How it works[edit]
Freeze authority
On Solana, a token's mint can keep a freeze authority. Only a mint that still has one can freeze token accounts, and a frozen account cannot send, receive or burn tokens until it is thawed.[3] Helius notes the freeze authority can be used maliciously to make a honeypot in which buyers are locked out of selling because their accounts are frozen.[2] Once the freeze authority is set to none it is removed permanently and the mint's accounts can no longer be frozen.[7][3] See Mint authority.
Token extensions
Solana's Token-2022 program adds optional extensions chosen at mint creation, among them transfer hooks, which let the issuer run a program on every transfer, transfer fees set in basis points with a maximum, and a permanent delegate.[4] In September 2024 a Jupiter contributor reported that a token called RED, which had a permanent delegate, burned a buyer's tokens seven seconds after the swap; PeckShield said the feature lets a designated party burn or move tokens held by any account of that mint.[5]
Sell restrictions in the contract
On other chains the restriction is written into the token contract. SQUID, a 2021 BNB Chain token themed on Squid Game, used what an analyst called an unusual "anti-dump" mechanism that stopped many holders from selling; sales were allowed only when buyers outnumbered sellers two to one.[6]
Detection[edit]
Explorers show a Solana token's authorities; on Helius's Orb explorer the absence of a freeze authority row means the token has none.[2] Launchpads such as pump.fun and LetsBonk set the mint authority to null for every token they create.[2] Cointelegraph advises testing a small sale before buying in size.[1]
Examples[edit]
- SQUID: buyers reported they could not sell; the creators appeared to cash out more than $3 million before the token collapsed on 1 November 2021.[6]
- RED (Solana): tokens burned from a buyer's wallet via a permanent delegate, reported on 3 September 2024.[5]
Timeline[edit]
- 2021-11-01: SQUID collapses after holders find they cannot sell[6]
- 2024-09-03: RED permanent-delegate burn reported by a Jupiter contributor[5]
See also[edit]
References[edit]
- ^ What is a honeypot crypto scam and how to spot it?, Cointelegraph, n.d.
- ^ How to Find Solana Mint, Freeze, and Update Authority, Helius, n.d.
- ^ Freeze account, Solana documentation, n.d.
- ^ A Developer's Guide to Token Extensions on Solana, Solana Foundation, 2024-01-24
- ^ Scammers have found a way to burn tokens from inside Solana wallets, Cointelegraph, 2024-09-04
- ^ Investors call scam after collapse of new cryptocurrency Squid, NBC News, 2021-11-02
- ^ Set authority, Solana documentation, n.d.