A honeypot contract is a malicious smart contract designed to appear as a legitimate token investment opportunity — allowing users to buy freely, while containing hidden code that prevents them from ever selling their tokens. Investors watch their "paper profits" grow but are permanently trapped, unable to exit their position. HOW HONEYPOT CONTRACTS WORK The attacker deploys a token contract that appears normal but contains one of several mechanisms to prevent selling: Blacklist function: The owner can add any address to a blacklist — preventing blacklisted addresses from selling. All buyer wallets are progressively added to the blacklist. Fee manipulation: The contract contains a hidden function that raises the sell tax to 100% after initial purchases. Only the owner (who set sell tax to 0% initially) can sell. Allowance exploit: The contract overrides the standard ERC-20 transfer function to require owner approval for sells — which is never granted to public buyers. Anti-sell conditions: Complex conditional logic that appears normal on casual inspection but blocks sells based on specific wallet conditions. HOW BUYERS GET TRAPPED A honeypot is typically seeded with initial liquidity and a small amount of organic-looking volume (from the attacker's own wallets). The token's price appears to rise. Buyers see profit on paper and attempt to sell — failing. New buyers continue entering, increasing the attacker's exit liquidity. Eventually, the attacker removes all liquidity (rug pull) or sells their founder allocation into trapped buyers. DETECTING HONEYPOTS BEFORE BUYING Token Sniffer (tokensniffer.com): Automated contract audit that identifies known honeypot patterns. Honeypot.is: Enter a token address to simulate a buy and sell transaction. If the simulated sell fails, it's a honeypot. Tenderly: Simulate contract calls to test sell functionality. Manual check: Read the contract on Etherscan/BSCScan. Look for onlyOwner functions affecting transfer logic, unusual fee structures, blacklist arrays. EXTRA WARNING SIGNS Token available only on one obscure DEX. Promoted heavily in Telegram groups with guaranteed profit claims. No contract audit. Newly deployed contract (< 24 hours old).