FLOUR FINANCIAL Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

FLOUR FINANCIAL (FLR) is a BNB Smart Chain token whose compiled code stores an address in a public variable called newun. The first transferFrom call with a non-zero from while newun is empty sets newun = to, and after that every transfer or transferFrom whose recipient is newun reverts with "please wait". When newun is a liquidity pair, that stops holders from sending tokens into it, which is how a sale on a DEX is executed, while buys and liquidity removal are not covered by the check.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, describing a contract whose owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The compiled TokenBEP20 constructor sets symbol = "FLR", name = "FLOUR FINANCIAL", decimals = 9 and gives the whole supply to owner. A public variable address public newun; starts empty.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from therefore records its recipient in newun without any check. If that call is the router moving tokens into a new liquidity pair during the first liquidity deposit, the pair address is the one captured.
  3. From then on, transferFrom takes the else branch and require(to != newun, "please wait") reverts any transfer whose recipient is newun. transfer has the same guard unconditionally: require(to != newun, "please wait");.
  4. A holder selling through a router calls transferFrom(holder, pair, amount). With newun set to the pair, to == newun and the call reverts, so the sale cannot go through. The check is on the recipient only, so a transfer from newun to another address, which is what a purchase from the pair is, is not blocked by it, and neither is the pair paying out to the address removing liquidity.
  5. The owner can change the guard. transfernewun(address _newun) is onlyOwner and overwrites newun. Pointing it at an address nobody uses lifts the block, while setting it to address(0) re-arms capture, so the next transferFrom call with a non-zero from records its recipient as the new blocked address.
  6. flourfinancial also exposes clearCNDAO(), restricted by onlyOwner, which sends the contract's own BNB balance to the owner. This is a separate power from the transfer guard.
  7. This describes what the code allows. The supplied source does not show which address newun held, whether it was ever changed, or whether any liquidity was removed on this deployment. The same capture-then-block pattern is described in an analysis of other BSC tokens, which gives it as a pool captured at setup and then blocked with require(to != newun, "please wait").

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract FLR

Evidence

Same attack technique

Browse all hacks →
Ethereum Croco Inu Loss not disclosed Ethereum ghostshiba.xyz Loss not disclosed Ethereum DeFi Wonderland Loss not disclosed BNB Chain 1Million Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes