Case Study: ERC-20 Token Audit — Arbitrary Blacklisting, Rug Pull, and 70% Hidden Transfer Tax on Ethereum
Executive Summary
This token includes a blacklist mechanism that the owner can apply to any address — including the Uniswap trading pair itself. Blacklisting the pair is functionally equivalent to a honeypot: all sells are blocked instantly, but buys can still be processed through alternative routing. The owner can deploy this block at any time with no notice or criteria.
Separately, a manual swap and send function lets the owner extract all accumulated tokens and ETH in a single call. LP tokens are sent to the owner at launch, completing the rug pull toolkit. A fourth issue — a hidden 70% tax on all wallet-to-wallet transfers outside the trading pair — is buried in the transfer logic and not disclosed anywhere in the contract documentation.
Risk Assessment
This contract contains three coordinated critical mechanisms: a discretionary honeypot via arbitrary blacklisting, a complete liquidity rug pull via owner-held LP tokens, and a hidden 70% tax on direct transfers. The combination makes this contract a severe risk to holders.
Key Findings
Owner Can Arbitrarily Blacklist Any Address Including Uniswap Pair — Honeypot Mechanism
What We Found
The owner can add any wallet to a blacklist that prevents it from sending or receiving tokens. This includes the Uniswap trading pair address — the contract that holds the liquidity pool. If the owner blacklists that address, every sell attempt is rejected instantly, while buys may still go through alternate routing. The owner can trigger this at any time with no warning, permanently trapping all current holders.
Why It Matters
Owner can create an on-demand honeypot at any time by blacklisting the primary liquidity pool. All holder funds become permanently inaccessible with no recovery path.
What Should Be Done
Remove the ability to blacklist the liquidity pair address. If a blacklist is needed for compliance reasons, explicitly exclude all known liquidity pool addresses and emit events with advance notice before any addition.
Centralized Fund Extraction — Rug Pull via manualSwap() and manualsend()
What We Found
Two functions let the owner swap all of the contract's accumulated tokens for ETH and then send that ETH anywhere — in a single pair of transactions with no limits, no approval requirements, and no time delay. The owner can silently drain all accumulated fees at any time. Combined with the ability to blacklist the trading pair, this forms a complete, two-step rug pull toolkit.
Why It Matters
Owner can drain 100% of accumulated tokens and ETH from the contract instantly. No notice, no limit, no multisig required. Combines with blacklist to complete a full rug pull.
What Should Be Done
Cap manual swap amounts to a percentage of the contract balance. Protect all fund movements with a 48-hour timelock and multisig approval. Emit advance-notice events for all queued withdrawals.
LP Tokens Sent to Owner Address — Immediate Liquidity Rug Pull Possible
What We Found
When the contract adds the initial liquidity to the trading pool, the LP tokens that represent ownership of that pool are sent directly to the owner's wallet. Whoever holds the LP tokens can remove the liquidity at any time. With the LP tokens in the owner's wallet from day one, the entire trading pool can be drained in a single transaction, making the token instantly worthless.
Why It Matters
Owner can execute a full liquidity removal at any time after launch. Combined with the blacklist mechanism and manual swap, this completes a three-vector rug pull.
What Should Be Done
Lock LP tokens in a reputable third-party time-lock contract for a minimum of 6-12 months at the moment of launch. Never send LP tokens to the owner wallet.
Hidden 70% Transfer Tax on All Wallet-to-Wallet Transfers
What We Found
Outside of the Uniswap trading pair, every direct transfer between wallets is subject to a 70% tax. If you send this token to a friend, a hardware wallet, or any address that isn't the trading pair, 70% of the tokens disappear. This tax is not disclosed anywhere in the contract interface or documentation — it is a hidden cost that most users would never discover until it is too late.
Why It Matters
Users lose 70% of their tokens on every non-pair transfer. This makes the token incompatible with wallets, DeFi protocols, staking contracts, or any use case outside of direct pair trading.
What Should Be Done
Disclose all transfer taxes prominently. Reduce the wallet-to-wallet tax to a reasonable level. Protect tax changes with a timelock so changes are visible before they take effect.
What a Secure Contract Should Have
Disclaimer: This case study is published for educational purposes only. It reflects the state of the analyzed contract at the time of audit and does not constitute investment advice, an endorsement, or a guarantee of security. Smart contracts may be modified after an audit. HyperAudit is not liable for losses arising from interaction with any contract referenced in this report. Project names and addresses have been removed to protect ongoing remediation efforts. For a full audit of your own contracts, visit hyperaudit.io.
Building a project?
Get the same depth of analysis on your own contracts before you deploy. Reports delivered in hours, not weeks.
Audit Your ContractThinking about buying a token?
Before you buy, find out if the contract is safe. We can audit any token on any EVM chain and tell you exactly what risks you're taking — in plain language you can act on.
Check a Token Before You Buy