FireBunny Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists FIREBUNNY as an exit scam/honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified BEP20 source (contract 0xb17c2b03…fc1d26) the control is an address called newun. transfer and transferFrom both revert with "please wait" when the recipient equals newun, and the first transferFrom while newun is unset stores that call's recipient in it.

Only the owner can change it afterwards, through transfernewun. If newun ends up as the liquidity pair, tokens can no longer be sent to the pair, which blocks selling. The code does not show who newun pointed at on-chain, and no opened source shows the losses.

How it happened

  1. The constructor sets _totalSupply = 1000000000000000000000000; (9 decimals, so 1 quadrillion tokens) and credits it to the deployer with balances[owner] = _totalSupply;.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. The first call made while newun is unset succeeds and records its recipient as newun. If that first call is the transfer that seeds a liquidity pair, the pair becomes newun; the code does not show which address it was.
  3. Every later transferFrom takes the else branch: else require(to != newun, "please wait");. Tokens can no longer be moved to newun through an allowance.
  4. transfer has its own check, require(to != newun, "please wait");, so a direct transfer to newun also reverts. Transfers to any other address are unaffected, and the sender is not exempt, including the owner.
  5. If newun is the pair, a holder's swap back to the base asset sends tokens to the pair and reverts, while buying (tokens leaving the pair to the buyer) is not blocked.
  6. The owner can change the block at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to address(0) re-arms the capture in step 2 for the next transferFrom; pointing it at an unused address lifts the block.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract FIREBUNNY

Evidence

Same attack technique

Browse all hacks →
BNB Chain Comet Loss not disclosed Ethereum Coordinape Loss not disclosed BNB Chain Moon Send Loss not disclosed BNB Chain ELONSAFE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes