BullsDrop Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

BullsDrop (BDROP) is a BEP20 token on BNB Smart Chain at 0x04c8f29b…566c9c. Its transfer and transferFrom functions reject any transfer whose recipient equals a stored address named newun. In transferFrom, the first call made while newun is empty stores that call's recipient as newun, and the owner can later change it with transfernewun.

A researcher's write-up of this same code pattern on other tokens describes newun being set to the liquidity pool address when liquidity is added, which blocks sells with a "please wait" error. De.Fi's REKT database lists BullsDrop as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. No transaction was opened that shows what newun held for this token, so the code is the evidence for how the block works.

How it happened

  1. The constructor sets symbol = "BDROP", name = "BullsDrop", decimals = 0 and _totalSupply = 1000000000, and credits the whole supply to the deployer with balances[owner] = _totalSupply;.
  2. transfer starts with require(to != newun, "please wait");, so no direct transfer can end at the newun address.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. While newun is empty, the first transferFrom call skips the check, goes through, and stores its own recipient in newun. When tokens are added to a DEX pool through a router, the router moves them with transferFrom, so the pool address is a natural recipient of that first call; the researcher's write-up describes exactly this for the pattern, and the code here does not show which address was stored.
  4. After newun is set, every later transferFrom and transfer to that address reverts with "please wait". A holder selling through a router would be sending to the pool with transferFrom, so the sale reverts if the pool is newun. The owner is not exempt from this check, and transfers to any other address still pass.
  5. The owner can change the target at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address makes the next transferFrom recipient become newun again. Owned has no renounce function.
  6. clearCNDAO is owner-only and sends the contract's own native-coin balance to the owner: _owner.transfer(address(this).balance);.
  7. What happened: De.Fi's REKT database lists this token as an Exit Scam/Honeypot dated 2021-04-25. No sale, liquidity or transfernewun transaction was opened, so none of those events is claimed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract BDROP

Evidence

Same attack technique

Browse all hacks →
Ethereum SuperMoon Token Loss not disclosed Ethereum Ares Protocol Loss not disclosed BNB Chain Pudgy Token Loss not disclosed Ethereum Floyd Crypto Mayweather Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes