Case Study: ERC-20 Tax Token Audit — Owner Rug Pull and Asymmetric Honeypot Conditions on Ethereum
Executive Summary
This token implements a buy-and-sell tax with an automated swap mechanism. The core functionality works, but the owner retains complete, unrestricted control over all funds. A dedicated rescue function allows draining every token and all ETH in a single transaction with no limits or delays.
Beyond the rug pull risk, the tax schedule is asymmetric: buy taxes are lowered quickly to attract buyers, but sell taxes remain elevated much longer. This creates a situation where holders face a much higher cost to exit than to enter — a pattern associated with tokens designed to trap holders.
A single EOA controls all of this with no multisig, no timelock, and no community visibility.
Risk Assessment
The contract is not a deliberate honeypot, but the owner has an unrestricted rug pull capability and the tax schedule disadvantages sellers over buyers. The risk is significant if the owner acts against holder interests.
Key Findings
Owner Can Drain All Tokens and ETH — Rug Pull Vectors
What We Found
The contract has functions that let the owner transfer any token held by the contract — including accumulated fees and LP tokens — and withdraw all ETH, in a single transaction, with no limits or waiting period. One person can empty everything instantly. There is nothing token holders can do to prevent or recover from this.
Why It Matters
Owner can drain 100% of all assets held by the contract at any time. No recovery mechanism exists. This is a complete and immediate rug pull capability.
What Should Be Done
Replace unrestricted drain functions with capped withdrawal functions gated behind a 48-72 hour timelock and multisig approval. Lock LP tokens in a third-party time-lock contract.
Single Owner EOA — Complete Centralization Risk
What We Found
One person's regular crypto wallet controls every function in this contract — changing fees, draining funds, controlling trading. If that wallet is ever hacked, stolen, or if the owner turns malicious, there is no backup key, no co-signer, and no way to stop them. The entire contract's security depends entirely on this one person's wallet security and intentions.
Why It Matters
If the owner key is compromised, all contract funds and holder balances are at risk. Ownership transfer to a renounced address would also permanently lock recovery.
What Should Be Done
Transfer contract ownership to a Gnosis Safe multisig requiring at least 2-of-3 signers. Apply timelocks to all sensitive functions.
Asymmetric Tax Schedule Creates Honeypot Conditions
What We Found
The buy tax drops to zero much faster than the sell tax. Early buyers pay little to get in but face a significant tax to get out. This asymmetry is a known pattern in scam tokens: attract buyers with low entry costs, then make it expensive to leave. Even if unintentional, it disproportionately harms holders who want to sell.
Why It Matters
Holders who buy early pay near-zero tax to enter but face elevated sell taxes when they want to exit, resulting in a financial trap that discourages selling.
What Should Be Done
Make buy and sell tax reduction schedules symmetric and disclose the full schedule in the token documentation before launch.
What a Secure Contract Should Have
Disclaimer: This case study is published for educational purposes only. It reflects the state of the analyzed contract at the time of audit and does not constitute investment advice, an endorsement, or a guarantee of security. Smart contracts may be modified after an audit. HyperAudit is not liable for losses arising from interaction with any contract referenced in this report. Project names and addresses have been removed to protect ongoing remediation efforts. For a full audit of your own contracts, visit hyperaudit.io.
Building a project?
Get the same depth of analysis on your own contracts before you deploy. Reports delivered in hours, not weeks.
Audit Your ContractThinking about buying a token?
Before you buy, find out if the contract is safe. We can audit any token on any EVM chain and tell you exactly what risks you're taking — in plain language you can act on.
Check a Token Before You Buy