What happened
Flamingo Boys (FLM) is an Ethereum ERC-20 token whose transfer and transferFrom functions revert for any transfer whose recipient equals a stored address called newun. transferFrom fills newun with the recipient of the first call made while it is empty, which on a DEX is typically the liquidity pair. After that, buyers receive tokens from the pair, but a sell sends tokens to the pair and reverts with "please wait".
The owner can also change newun with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and describes it as a contract where the owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor mints the whole supply to the deployer, who becomes
owner:_totalSupply = 1000000000000000000;andbalances[owner] = _totalSupply;(10^18 raw units, 10 billion tokens at 8 decimals). - The contract keeps a variable
address public newun;that is empty at deployment.transferFromrunsif(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");, so the firsttransferFrommade whilenewunis empty passes and stores its recipient innewun. On a DEX, the router'stransferFromthat moves tokens into the pair when liquidity is added would be that first call. - From then on both transfer paths check the recipient:
require(to != newun, "please wait");intransferand the sameelse require(to != newun, "please wait");branch intransferFrom. A sell routes the holder's tokens to the pair withtransferFrom, so it reverts. Buys send tokens from the pair to the buyer, whose address differs fromnewun, so they succeed. - The owner can change the block at any time with
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointingnewunat an unused address lifts the sell block. Setting it to the zero address re-arms capture, so the nexttransferFromstores a new recipient. There is norenounceOwnership;transferOwnershiponly hands the role to another address. - The source header comment advertises 5% auto-liquidity, 3% holder reward, 2% burn, a 1,000,000,000,000 total supply and a trade limit, but the code contains no fee, reflection, burn or trade-limit logic, and the constructor mints 10^18 raw units at 8 decimals. The code also gives the owner
clearCNDAO, which sends any ETH held by the token contract to the owner:_owner.transfer(address(this).balance);. - What happened: De.Fi's REKT database lists this token as an Exit Scam/Honeypot dated 2021-09-20 with no loss figure. No opened transaction or holder page in this review shows a specific
transfernewuncall, a failed sell, or a liquidity removal.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
