Contracts that implement a require() check within their transfer() function to restrict transfers to a whitelist of addresses represent a core structural pattern relevant to "AI scam detector" contexts. Mechanically, this pattern permits transactions such as buys from non-whitelisted addresses but reverts sell transactions if the seller’s address is not on the whitelist. This creates a one-way liquidity flow where tokens can be acquired but not sold, often without visible signs in price charts or transaction histories. The require() condition enforces this at the protocol level, meaning the restriction is embedded in the token’s fundamental transfer logic rather than external controls.
This whitelist-only exit pattern becomes risk-relevant primarily when the whitelist is owner-modifiable post-launch, allowing the project team to selectively enable or disable selling rights. In such cases, the owner retains the ability to block exits for most holders, effectively creating a soft honeypot. Conversely, if the whitelist is immutable or permanently set before launch, the pattern may be benign and serve compliance or anti-bot purposes. The presence of a whitelist alone does not imply malicious intent; it can exist for regulatory compliance or phased token release strategies, provided that the whitelist cannot be altered arbitrarily by a centralized party.
Additional signals that would meaningfully alter the risk assessment include the presence of owner-controlled adjustable sell taxes, active mint or freeze authorities, or pause functions. For example, if the contract also allows the owner to raise sell taxes arbitrarily, this compounds exit risk by increasing transaction costs on sales. Active mint authority without clear operational justification suggests potential for inflationary dilution. Similarly, the ability to freeze transfers or pause the contract adds layers of forced exit blocking. Conversely, multisig or timelocked governance over these functions, or public renouncement of critical authorities, would reduce the likelihood of abuse and shift the pattern toward a more benign interpretation.
When the whitelist-only exit pattern combines with other common risk factors, the range of outcomes can vary from mild inconvenience to severe liquidity traps. For instance, coupling whitelist restrictions with upgradeable proxy patterns lacking timelocks can enable sudden and opaque logic changes that reinforce exit barriers. Similarly, owner-controlled blacklist functions can selectively freeze or block wallets, exacerbating the pattern’s impact. In less severe cases, whitelist enforcement combined with transparent governance and immutable settings may simply enforce legitimate compliance or staged release mechanisms. The interplay of these factors determines whether the pattern functions as a protective measure or a mechanism for exit blocking and potential scam behavior.