EXEEDME.FINANCE Honeypot

What happened

EXEEDME.FINANCE (XEED) is a BNB Chain token deployed on 26 March 2021 at 0x46ca7c27…820711. The first transferFrom from a non-zero address stores its destination in a variable called newun, and from then on every transfer or transferFrom whose destination is newun reverts with "please wait". When liquidity is added through the PancakeSwap router, that first destination is the pool, so buyers can receive tokens from the pool but cannot send tokens back to it to sell.

The owner can repoint newun at any time with transfernewun. De.Fi's REKT database lists XEED as an exit scam/honeypot.

How it happened

1. The constructor credits the full 255,000 XEED supply to the owner, and newun starts as the zero address.
2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to;. When the owner adds liquidity through the router, the router pulls tokens with transferFrom(owner, pair, amount), so the pair address is written into newun.
3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer starts with the same check. Buys still work because the pair sends tokens out with transfer to the buyer.
4. A sale has to deliver tokens to the pair, through the router's transferFrom or a direct transfer, so it reverts for every holder.
5. Only the owner can call transfernewun(address _newun) to move the block, and removing liquidity sends tokens out of the pair, which the check does not touch.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract XEED

Evidence

• report Token Sniffer post 1381346761566916614 (seed link) twitter.com
• transaction XEED contract creation transaction bscscan.com
• address EXEEDME.FINANCE (XEED) verified contract code on BscScan bscscan.com
• analysis BSC-SCAM: Stealthy LP block (cryptot3ddybear, 11 April 2021) cryptot3ddybear.gitlab.io
• analysis Sourcify match for 0x46ca7c27ab24ad14a7401ef7905f27aaf2820711 on BNB Chain repo.sourcify.dev