Blog/Case Study
EthereumERC-20 Token with Tax MechanismJuly 2026343 lines

Case Study: ERC-20 Tax Token Audit — Owner Rug Pull and Asymmetric Honeypot Conditions on Ethereum

62/100
Risk Score (B)
20
Total Findings
3
Critical + High
Severity Distribution

Executive Summary

This token implements a buy-and-sell tax with an automated swap mechanism. The core functionality works, but the owner retains complete, unrestricted control over all funds. A dedicated rescue function allows draining every token and all ETH in a single transaction with no limits or delays.

Beyond the rug pull risk, the tax schedule is asymmetric: buy taxes are lowered quickly to attract buyers, but sell taxes remain elevated much longer. This creates a situation where holders face a much higher cost to exit than to enter — a pattern associated with tokens designed to trap holders.

A single EOA controls all of this with no multisig, no timelock, and no community visibility.

Risk Assessment

The contract is not a deliberate honeypot, but the owner has an unrestricted rug pull capability and the tax schedule disadvantages sellers over buyers. The risk is significant if the owner acts against holder interests.

Key Findings

critical

Owner Can Drain All Tokens and ETH — Rug Pull Vectors

What We Found

The contract has functions that let the owner transfer any token held by the contract — including accumulated fees and LP tokens — and withdraw all ETH, in a single transaction, with no limits or waiting period. One person can empty everything instantly. There is nothing token holders can do to prevent or recover from this.

Why It Matters

Owner can drain 100% of all assets held by the contract at any time. No recovery mechanism exists. This is a complete and immediate rug pull capability.

What Should Be Done

Replace unrestricted drain functions with capped withdrawal functions gated behind a 48-72 hour timelock and multisig approval. Lock LP tokens in a third-party time-lock contract.

high

Single Owner EOA — Complete Centralization Risk

What We Found

One person's regular crypto wallet controls every function in this contract — changing fees, draining funds, controlling trading. If that wallet is ever hacked, stolen, or if the owner turns malicious, there is no backup key, no co-signer, and no way to stop them. The entire contract's security depends entirely on this one person's wallet security and intentions.

Why It Matters

If the owner key is compromised, all contract funds and holder balances are at risk. Ownership transfer to a renounced address would also permanently lock recovery.

What Should Be Done

Transfer contract ownership to a Gnosis Safe multisig requiring at least 2-of-3 signers. Apply timelocks to all sensitive functions.

high

Asymmetric Tax Schedule Creates Honeypot Conditions

What We Found

The buy tax drops to zero much faster than the sell tax. Early buyers pay little to get in but face a significant tax to get out. This asymmetry is a known pattern in scam tokens: attract buyers with low entry costs, then make it expensive to leave. Even if unintentional, it disproportionately harms holders who want to sell.

Why It Matters

Holders who buy early pay near-zero tax to enter but face elevated sell taxes when they want to exit, resulting in a financial trap that discourages selling.

What Should Be Done

Make buy and sell tax reduction schedules symmetric and disclose the full schedule in the token documentation before launch.

What a Secure Contract Should Have

Token and ETH withdrawal functions are capped per call and require multisig approval
All sensitive owner functions are protected by a 48-hour timelock
Buy and sell tax reduction schedules are identical — no asymmetric entry/exit cost
Ownership is held by a multisig wallet with at least 2-of-3 signers
LP tokens are locked in a reputable third-party locker for 6-12 months minimum

Disclaimer: This case study is published for educational purposes only. It reflects the state of the analyzed contract at the time of audit and does not constitute investment advice, an endorsement, or a guarantee of security. Smart contracts may be modified after an audit. HyperAudit is not liable for losses arising from interaction with any contract referenced in this report. Project names and addresses have been removed to protect ongoing remediation efforts. For a full audit of your own contracts, visit hyperaudit.io.

Building a project?

Get the same depth of analysis on your own contracts before you deploy. Reports delivered in hours, not weeks.

Audit Your Contract

Thinking about buying a token?

Before you buy, find out if the contract is safe. We can audit any token on any EVM chain and tell you exactly what risks you're taking — in plain language you can act on.

Check a Token Before You Buy