BathroomSwap Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

BathroomSwap is a BEP20 token on BNB Smart Chain whose transfer and transferFrom refuse any move into one stored address, newun. The first transferFrom call made while newun is unset stores that call's recipient there, and the owner can also change it with transfernewun. If the stored address is the liquidity pool, buying still works but sending tokens into the pool, which is what a sell does, reverts with "please wait".

De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the contract owner could disable the transfer function, restricting users from selling their tokens. The contract also lets the owner withdraw any BNB the token contract holds.

How it happened

  1. transferFrom opens with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from while newun is empty stores its recipient in newun and skips the check. The code does not say which address that is; if the first such call is the liquidity deposit, newun becomes the pool.
  2. transfer contains require(to != newun, "please wait"); and the else branch of transferFrom applies the same test, so every later transfer into newun reverts.
  3. A sell sends the token into the pool, so with newun pointing at the pool it fails. Buys move tokens out of the pool to a buyer whose address is not newun, so they pass, and the holder's balance is only debited when the transfer succeeds.
  4. transfernewun(address _newun) public onlyOwner lets the owner rewrite newun. Setting it to the zero address re-arms capture on the next transferFrom with a non-zero from; pointing it at an unused address would lift the block.
  5. clearCNDAO() is onlyOwner and runs _owner.transfer(address(this).balance), so the owner can pull out any BNB the token contract itself holds. The fallback function() external payable lets the contract receive BNB.
  6. What happened: De.Fi's REKT database lists this token as a honeypot/exit scam. No transaction showing the owner changing newun, removing liquidity, or any holder's failed sell was opened, and no loss figure is given.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BathroomSwap

Evidence

Same attack technique

Browse all hacks →
BNB Chain DogeStar Loss not disclosed BNB Chain SPACEDOGE Loss not disclosed BNB Chain Pigg Token Loss not disclosed BNB Chain EMACITY TOKEN Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes