What happened
De.Fi's REKT database lists GO on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling their tokens. The verified source shows how: a newun address is recorded on the first transferFrom call, and every later transfer or transferFrom to that address reverts with "please wait". If newun is the liquidity pair, holders can receive tokens from it but cannot send tokens back to it, so swaps that sell the token fail.
The owner can also call transfernewun to change the blocked address, and clearCNDAO sends any BNB held by the contract to the owner.
How it happened
- The token is deployed with
newununset (the zero address) and the whole supply credited to the owner:balances[owner] = _totalSupply;. - The first
transferFromwherefromis non-zero whilenewunis still unset records the recipient:if(from != address(0) && newun == address(0)) newun = to;. A router moving tokens into a new liquidity pair during pool creation would be such a call, which would make the pair the blocked address. The code allows this; the pool address itself was not checked against a transaction. - After that, every later
transferFromtakes the other branch:else require(to != newun, "please wait");. A sell through a router moves tokens to the pair withtransferFrom, so it reverts. - Direct transfers are blocked the same way:
require(to != newun, "please wait");intransfer. - Buys are not affected, because tokens leave the pair as the
fromside and the check only looks at the recipient. - The owner keeps control of the switch through
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address re-arms the capture on the nexttransferFrom; pointing it at an unused address would lift the block. - The listing records no loss amount, so the size of the trapped holdings is not established here.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
