What Is a Honeypot Contract and How Does It Work?
A honeypot token is one you can buy but never sell. The trap is not a market condition — it is a deliberate feature built into the transfer logic. Here is how each mechanism works, what it looks like in the code, and how to check for it before buying.
What is a honeypot token?
A honeypot is a token whose smart contract allows purchases but prevents or heavily penalizes sales. The name comes from the idea of honey attracting bees — the price chart looks attractive (only buys, no sells means the price only goes up), but once you buy in, your tokens are trapped.
Unlike a rug pull, which drains liquidity, a honeypot simply locks you in. The deployer is the only wallet that can sell. They watch the price climb as buyers pile in, then sell their own allocation — crashing the price while everyone else is stuck holding tokens they cannot move.
How does a honeypot stop you from selling?
There are four common mechanisms. Most honeypots use one or two; the most sophisticated use all four together.
1. Broken balanceOf
The function that reports your token balance to DEX platforms returns zero for regular holders but returns the real balance for the deployer. When you try to sell, the DEX sees you own zero tokens and rejects the trade.
function balanceOf(address account) public view returns (uint256) {
if (tx.origin == deployer) return _balances[account];
return 0; // everyone else sees zero
}2. Conditional Sell Block
The transfer function contains a hidden check: if the recipient is the liquidity pool (i.e., you are selling), the transaction reverts unless the sender is the deployer. Buys work normally because the pool is the sender, not the recipient.
function _transfer(address from, address to, uint256 amount) internal {
if (to == uniswapPair && from != owner()) {
revert("Transfer failed"); // only owner can sell
}
super._transfer(from, to, amount);
}3. Fee Escalation
The sell fee starts at a reasonable-looking 3-5% but the owner can change it to 99% at any time. You can technically sell, but 99% of the value goes to the deployer. This is harder to detect because the initial fee looks normal.
uint256 public sellFee = 5; // looks reasonable at launch
function setSellFee(uint256 newFee) external onlyOwner {
sellFee = newFee; // can be set to 99 at any time
}4. Delayed Blacklist
The contract includes a blacklist function but the deployer does not use it immediately. They wait until enough buyers are in, then blacklist every holder except themselves. Now only the deployer can transfer.
function blacklistBatch(address[] calldata addrs) external onlyOwner {
for (uint i = 0; i < addrs.length; i++) {
_blacklisted[addrs[i]] = true; // block hundreds of wallets at once
}
}Can you detect a honeypot before buying?
Yes, if the contract source code is verified on the block explorer. Look for:
- Conditional logic in the transfer function that treats the deployer differently from other holders
- A balanceOf function that does anything other than return the stored balance directly
- Fee variables that can be changed after deployment with no on-chain cap
- Blacklist or pause functions with no timelock or governance
- tx.origin used anywhere — it is a known flawed authorization technique and a honeypot signal
- Obfuscated variable names — intentionally confusing code is a red flag on its own
If the source is not verified, treat it as a warning. A team that hides the code has something to hide.
What happens to your money?
Your BNB or ETH is gone. When you bought the token, your BNB went into the liquidity pool. The deployer — who can sell — takes their tokens out of the pool for BNB. Your tokens remain in your wallet but have no value because you cannot sell them and no one else can either.
This is not recoverable. On-chain transactions are permanent. There is no customer service, no chargeback, and no regulator who can reverse the trade. The only defense is checking before you buy.
Check any token before buying
Token Check — $29. Paste the address, get a risk grade with plain-English findings. Catches honeypot patterns, rug pull signals, and centralization risks.
Check a Token