ElonProtocol Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ElonProtocol (ELONPRO) is a BEP-20 token on BNB Chain whose source comment advertises reflections, auto-liquidity and a 365-day liquidity lock, none of which the code implements. Instead, the first transferFrom from a non-zero address stores its recipient in a hidden variable newun; when liquidity is added through the PancakeSwap router, that recipient is normally the liquidity pair. After that, every transfer or transferFrom whose destination is newun reverts with please wait, so holders can buy from the pool but cannot sell into it.

The owner can repoint newun at any time with transfernewun. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.

How it happened

  1. The constructor credits the full supply of 100000000000000000000 raw units (8 decimals) to the owner.
  2. The first transferFrom with a non-zero sender runs if(from != address(0) && newun == address(0)) newun = to;. When the router adds liquidity, it pulls tokens with transferFrom into the PancakeSwap pair, so the pair can become newun.
  3. Buying still works, because the pair sends tokens out to buyers and only transfers *to* newun are checked.
  4. A sale sends tokens to the pair, so both transfer and transferFrom hit require(to != newun, "please wait") and revert.
  5. The owner can call transfernewun to point newun elsewhere, which would reopen sells to the pair, and can later set it back. clearCNDAO lets the owner withdraw any BNB held by the token contract.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ELONPRO

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.