BSCstarter Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

BSCstarter (START) is a BNB Chain token deployed on 23 May 2021 at 0x1286caa7…472dec by 0x63C8fe5f…dFdeb1. Its transferFrom saves the recipient of the first transferFrom call as newun; when the owner adds liquidity through the PancakeSwap router, that recipient is the pair. After that, every transfer or transferFrom into newun reverts with "please wait", so buys out of the pair work but no holder can sell into it.

Only the owner can change newun, through transfernewun, and removing liquidity sends tokens out of the pair, so the LP holder's exit stays open. Ownership can be handed over in two steps but the contract has no renounceOwnership. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor credits the whole supply, 1,000,000,000,000 tokens with 0 decimals, to the owner.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. The router's addLiquidityETH moves the owner's tokens into the pair with transferFrom, which would set newun to the pair.
  3. From then on transferFrom runs require(to != newun, "please wait"), and transfer runs the same check. A router sale sends the seller's tokens into the pair, so it reverts; buys send tokens out of the pair and pass.
  4. transfernewun(address _newun) is onlyOwner, so only the owner can point newun elsewhere and reopen sales.
  5. Whoever holds the LP tokens can remove liquidity at any time, because the pair paying out tokens is a transfer from newun, not to it. The blog post De.Fi cites describes this template's exit as pulling liquidity after one-way buying.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract START

Evidence

Same attack technique

Browse all hacks →
BNB Chain Redbean Token Loss not disclosed BNB Chain HolyMoon Loss not disclosed BNB Chain WOO Loss not disclosed BNB Chain SpaceGoat Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes