07 · Sell path clears

The question

Once you hold it, can you get rid of it?

A honeypot is a token where buying works and selling reverts, or sells only for a chosen few. Static reading catches most of the mechanisms (checks 02, 04, 05), but the surest way to know a door opens is to walk through it.

How it decides

The check needs a deployed contract and someone who holds it.

1. It reads the token's Transfer events from the chain, newest first, and collects up to forty recipient addresses. From those it keeps the ones that are wallets, not contracts (no code at the address), and picks the one with the largest balance. This is the holder.
2. It starts a fork of Robinhood Chain at the current block with anvil.
3. On the fork it impersonates the holder and sends one thousandth of their balance (at least one unit) to a fresh address that has never existed.
4. It impersonates the fresh address and sends the same amount back to the holder.
5. Both transactions must succeed.

• Both succeed: pass. In and out from a fresh address on a fork, nothing kept. or …, 30000 kept as tax.
• The first reverts: fail. A transfer from the largest holder to a fresh address reverted on a fork.
• The second reverts: fail. A fresh address received tokens but could not send them back on a fork.
• Not deployed, or no wallet holds it yet: not run. Runs again after launch.

What it is, and what it is not

It is a transfer, not a swap through a pool. A tax that only applies when the recipient is the pool, or a revert that only triggers on a swap, is not exercised. The note on every seal says so in those words.

It is a test of the current state on the fork. A token that is open today and can be closed tomorrow passes 07 and fails 05, which is why both exist.

Why "not run" is not "pass"

A seal made from pasted bytecode, before deployment, shows 07 as not run and counts 7 of 8. That is the honest count. Once the token is live and held, the developer can resubmit at the same commit, the match is the same, and 07 gets its answer.

Known edges

If every recent recipient is a contract (a pool, a locker, a vesting contract), no holder is found and the check does not run. If the largest holder is the deployer and the code exempts the deployer from restrictions, the check may pass where a normal holder would fail; the fresh address in step 4 is what guards against that, since it is nobody's.