BinanceInu.Bep20 Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

BinanceInu.Bep20 (BNBIN) is a BEP-20 token on BNB Chain that blocks every sale into its liquidity pool. The first transferFrom the contract sees, normally the PancakeSwap router pulling the owner's tokens into the new pair when liquidity is added, stores that recipient in a variable named newun. After that, both transfer and transferFrom revert with please wait whenever the recipient is newun, so holders can buy from the pool but cannot sell back into it.

The owner can repoint newun at any time with transfernewun. The same newun trap was documented in April 2021 in BNB Chain tokens such as SafeRocket; De.Fi's REKT database lists BinanceInu.Bep20 as an exit scam/honeypot, with no loss figure.

How it happened

  1. The constructor credits the whole supply, 1000000000000000e9 raw units (10^22 BNBIN at 2 decimals), to the owner; newun starts as address(0).
  2. When liquidity is added through the PancakeSwap router, the router calls transferFrom(owner, pair, amount). Because newun == address(0), the line if(from != address(0) && newun == address(0)) newun = to; records the pair as newun and lets that first transfer through.
  3. Buys still work: the pair sends BNBIN to the buyer with transfer, and the buyer is not newun.
  4. A sell sends BNBIN to the pair, through the router's transferFrom or a direct transfer. Both check require(to != newun, "please wait"), so every sell reverts with a message that suggests a temporary delay.
  5. transfernewun(address _newun) is onlyOwner, so the owner can move the block to another address, which would reopen sells, or reset it to zero so the next transferFrom recipient is blocked instead.
  6. Removing liquidity sends BNBIN out of the pair rather than into it, so the block does not stop whoever holds the LP tokens from withdrawing the pool's BNB.
  7. clearCNDAO() lets the owner withdraw any BNB held by the token contract itself. There is no renounceOwnership; ownership changes only when a new address calls acceptOwnership after transferOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BNBIN

Evidence

Same attack technique

Browse all hacks →
BNB Chain DiamondBalls Loss not disclosed BNB Chain Lizard finance Loss not disclosed BNB Chain MEDUZA TOKEN Loss not disclosed BNB Chain sixpackfinance.org Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes