ElonProtocol Honeypot
What happened
ElonProtocol (ELONPRO) is a BEP-20 token on BNB Chain whose source comment advertises reflections, auto-liquidity and a 365-day liquidity lock, none of which the code implements. Instead, the first transferFrom from a non-zero address stores its recipient in a hidden variable newun; when liquidity is added through the PancakeSwap router, that recipient is normally the liquidity pair. After that, every transfer or transferFrom whose destination is newun reverts with please wait, so holders can buy from the pool but cannot sell into it.
The owner can repoint newun at any time with transfernewun. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor credits the full supply of
100000000000000000000raw units (8 decimals) to the owner. - The first
transferFromwith a non-zero sender runsif(from != address(0) && newun == address(0)) newun = to;. When the router adds liquidity, it pulls tokens withtransferFrominto the PancakeSwap pair, so the pair can becomenewun. - Buying still works, because the pair sends tokens out to buyers and only transfers *to*
newunare checked. - A sale sends tokens to the pair, so both
transferandtransferFromhitrequire(to != newun, "please wait")and revert. - The owner can call
transfernewunto pointnewunelsewhere, which would reopen sells to the pair, and can later set it back.clearCNDAOlets the owner withdraw any BNB held by the token contract.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address ElonProtocol (ELONPRO) verified contract source, BscScan bscscan.com
- analysis Sourcify match, chain 56, 0xa4ec9981e3a5bd9a9856ee4ace76afcf7e051627 repo.sourcify.dev
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.