What happened
Blowfish Token (BFSH) is an Ethereum token deployed on 20 April 2021 at 0x2a6d46fe…4451b4 by 0x56BA0FA3…8Ae5fA; Etherscan labels the contract Fake_Phishing228704. Its transferFrom saves the recipient of the first transferFrom call as newun; when liquidity is added through a router, that recipient is the pool. After that, every transfer or transferFrom into newun reverts with "please wait", so buys out of the pool work but no holder can sell into it.
Only the owner can change newun, through transfernewun, and removing liquidity sends tokens out of the pool, not into it, so it stays open. The contract has no renounceOwnership, and the header's claim that liquidity is locked for 365 days is not enforced anywhere in this code. De.Fi's REKT database lists the token as an exit scam/honeypot.
How it happened
- The constructor mints the whole supply, 1,000,000,000,000 BFSH (
100000000000000000000at 8 decimals), to the owner. transferFrombegins withif(from != address(0) && newun == address(0)) newun = to;. When a router's add-liquidity call moves the owner's tokens into the pool withtransferFrom, the pool becomesnewun.- From then on
transferFromrunsrequire(to != newun, "please wait"), andtransferruns the same check. A router sale sends the seller's tokens into the pool, so it reverts; buys send tokens out of the pool and pass. transfernewun(address _newun)isonlyOwner, so only the owner can pointnewunelsewhere and reopen sales.- Whoever holds the pool's LP tokens can remove liquidity at any time, because the pool paying out tokens is a transfer from
newun, not to it. The blog post De.Fi cites describes this template's exit as pulling liquidity after one-way buying.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report Token Sniffer post 1381346761566916614 (seed link) twitter.com
- transaction Blowfish Token contract creation transaction on Etherscan etherscan.io
- address Blowfish Token (BFSH) verified contract code on Etherscan etherscan.io
- analysis Sourcify match for 0x2a6d46fe4a0f9ee5ba350e77cf621ed0a74451b4 on Ethereum repo.sourcify.dev
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap (cryptot3ddybear, 11 April 2021) cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
