What happened
De.Fi's REKT database lists ELONSAFE as an exit scam/honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified BEP20 source (contract 0x429b77a6…2a364c) the control is an address called newun. transfer and transferFrom both revert with "please wait" when the recipient equals newun, and the first transferFrom while newun is unset stores that call's recipient in it.
Only the owner can change it afterwards, through transfernewun. If newun ends up as the liquidity pair, tokens can no longer be sent to the pair, which blocks selling. The code does not show who newun pointed at on-chain, and no opened source shows the losses.
How it happened
- The constructor mints the whole supply to the deployer:
_totalSupply = 1000000000000000000000000000000;(18 decimals, so 1 trillion tokens) andbalances[owner] = _totalSupply;. transferFrombegins withif(from != address(0) && newun == address(0)) newun = to;. The first call made whilenewunis unset succeeds and records its recipient asnewun. If that first call is the transfer that seeds a liquidity pair, the pair becomesnewun; the code does not show which address it was.- Every later
transferFromtakes theelsebranch:else require(to != newun, "please wait");. Tokens can no longer be moved tonewunthrough an allowance. transferhas its own check,require(to != newun, "please wait");, so a direct transfer tonewunalso reverts. Transfers to any other address are unaffected, and the sender is not exempt, including the owner.- If
newunis the pair, a holder's swap back to the base asset sends tokens to the pair and reverts, while buying (tokens leaving the pair to the buyer) is not blocked. - The owner can change the block at any time with
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to address(0) re-arms the capture in step 2 for the nexttransferFrom; pointing it at an unused address lifts the block.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
