bsc

I Audited BSC's Top Gainer Today: Some On-Chain Traps Hiding in Plain Sight
Source: https://bscscan.com/token/0xfe189e97832da1573e4e4ff034f4ffc3a15c7777#code
🚩🚩🚩🚩🚩
Everyone is chasing the +61% green candle on $MARSCOIN today. $54M volume, trending on CoinMarketCap, 11.61K holders.
I spent some minutes on BscScan and:
Here is a full breakdown for beginners on how to spot a modern honeypot, using $MARSCOIN `0xFe189E97832DA1573e4e4Ff034F4fFC3a15c7777` as a live case study.
And at the end, I will show you what the opposite looks like.
🚨1. The Volume Illusion: Vol/Mkt Cap 162.08%
On CoinMarketCap, MarsCoin shows:
Volume (24h): $54.01M
FDV: $34.91M
Vol/Mkt Cap: 162.08%
A healthy token trades 5-15% of its market cap per day. When volume exceeds 100% of FDV, it means the entire supply was traded 1.6x in 24 hours. This is not organic demand. This is wash trading via bots, self-loops in the same transaction.
Why? To rank on trending, trigger bots, and create FOMO.
Second red flag on the same screen:
Liq/Mkt Cap: 3.67%
FDV is $34M but real liquidity is only ∼$1.2M. That means a $20k sell can crash the price 20-30%. You can buy, but you can't exit. This is a classic trap liquidity setup.
🚨2. The Mutable Tax: Read as Proxy
On BscScan > Contract > Read as Proxy, we find:
`8. buyTaxRate: 300`
`5. antiFarmerDuration: 2592000`
`6. antiFarmerExpirationTime: 1787750591`
Translation:
- 300 in basis points = 3% visible tax. Looks low and safe to attract you.
- 2592000 seconds = 30 days of hidden punitive tax.
- 1787750591 = August 25, 2026.
If you buy and try to sell within 30 days, you don't pay 3%. You pay the hidden anti-farmer tax, often 30-99%. The contract holds your tokens hostage until the expiration. This is how 11.6K holders get trapped.
In an immutable contract, `buyTaxRate` and `antiFarmer` functions do not exist.
🚨3. The Reset Button: Write Contract - initialize & migration
On BscScan > Write as Proxy:
`5. initialize (0x1e1b5429) - params`
`8. startMigration (0x18264f33)`
`3. finalizeMigration (0xb78b60...)`
This is a Minimal Proxy pattern. The implementation is at `0x024fd...` and the logic can be changed.
`initialize` means the owner can re-initialize the proxy with new parameters at any time. It's a reset button.
`startMigration` / `finalizeMigration` is the most dangerous rug function in 2024-2026. The owner can announce a "V2 migration", freeze your old tokens, drain the liquidity to a new contract, and if you miss the migration window, you lose everything. 90% of proxy rugs use this exact pair.
A safe token has 6 functions: `transfer, approve, balanceOf, allowance, totalSupply, decimals`. Not migration engines.
🚨4. The Final Kill: Ownership Can Be Sold + Permit Phishing
On Write as Proxy Part 2:
`11. transferOwnership (0xf2fde...) - newOwner`
`7. renounceOwnership (0x7150...)`
`6. permit (0xd505accf) - owner, spender, +5 More`
BscScan description confirms: "Transfers ownership of the contract to a new account (newOwner). Can only be called by the current owner."
This means the admin rights can be sold OTC for a few BNB. Even if the current owner looks doxxed or safe, he can sell the contract to a rugger in seconds. `renounceOwnership` is theater here, because with `initialize` available, ownership can be reborn after renouncing.
`permit` with `+5 More` hidden params enables off-chain signature phishing. A fake "Migrate your $MARSCOIN to V2" website asks you to sign, you sign the `permit`, and your wallet is drained without a single approval transaction.
The Opposite: What Safe Infrastructure Looks Like - BTX
This is why I track BTX, not because of hype, but because it's the inverse of everything above.
I analyzed its on-chain engine:
- No `buyTaxRate`, No `sellTaxRate`, No `antiFarmer`, No `initialize`, No `startMigration`, No `transferOwnership`.
- Only 6 immutable functions. No owner(). No mint(). No upgradeable proxy.
- 74.71% locked and verifiable.
- 20M+ transactions are not wash trading. They are precise royalty distributions like `318.2522961949 BTX`. A bot washing volume doesn't use 10 decimals. A royalty engine does.
- $7.1M+ in royalties are verifiable on http://beatswap.io/dashboard, not just on a CEX chart.
High volume ≠ demand. Low tax ≠ safe.
Learn to read `Read as Proxy` and `Write as Proxy` before you read the price chart.
Stay safe!!
#dyor #BSC #CryptoSecurity