Arsenal FC Fan Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ARS (on-chain name Arsenal FC Fan Token, BNB Chain contract 0x8018099b…c9f54f) is a BEP-20 token whose transfer and transferFrom both refuse to deliver tokens to one stored address, newun. transferFrom fills newun with the recipient of the first call made while it is empty, so a router liquidity deposit would record the trading pair, and from then on a router sell, which delivers the holder's tokens to the pair, reverts with "please wait". Only the owner can overwrite newun, through transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens; no sell transaction, pool address or loss figure was opened to confirm what happened on-chain.

How it happened

  1. newun is declared as address public newun; and is not assigned in the constructor, so it starts as the zero address.
  2. In transferFrom, the first call with a non-zero from while newun is empty runs if(from != address(0) && newun == address(0)) newun = to;. That branch stores the recipient and skips the require. If this call is the router moving tokens into a new pool, newun becomes the pool address.
  3. Every later call hits else require(to != newun, "please wait"); in transferFrom, and transfer has require(to != newun, "please wait");. A sell through a router moves the holder's tokens to the pool with transferFrom, so to == newun and the call reverts before balances[from] = balances[from].sub(tokens); runs; the holder's balance is unchanged and the tokens simply cannot be sold into that pool.
  4. A purchase delivers tokens from the pool to the buyer, so to is the buyer, not newun, and the transfer succeeds. Buying works while selling to the pool does not.
  5. The check has no exemption for any sender, owner included. The onlyOwner function transfernewun(address _newun) can set newun to any address: pointing it at an unused address lifts the block, while setting it to the zero address re-arms the capture so the next transferFrom recipient becomes the blocked address. The contract has no renounceOwnership; ownership can only be handed to another address through transferOwnership and acceptOwnership. The source does not show whether or when these functions were called.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ARS

Evidence

Same attack technique

Browse all hacks →
Ethereum Dragon Farm Loss not disclosed BNB Chain Fear NFTs Loss not disclosed BNB Chain MechaGodzilla Loss not disclosed BNB Chain Pitbull Classic Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes