HighQuality Swap Honeypot
What happened
HighQuality Swap (hQUAL) is a BNB Smart Chain token with a hidden recipient block. transferFrom stores the recipient of its first call in newun, and from then on both transfer and transferFrom revert with "please wait" for any transfer to that address. If that first call was the one that added liquidity, the pool is the blocked recipient and sells into it fail, while a pool sending tokens to a buyer is not stopped by this check.
The owner can repoint newun with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-26, with the note that the owner could disable the transfer function and restrict users from selling.
How it happened
- The constructor gives the whole supply to the deployer and leaves
newunat the zero address. - In
transferFrom, the lineif(from != address(0) && newun == address(0)) newun = to;stores the recipient of the first such call asnewun, with no check on that call. If that call is the liquidity-adding transfer into a pool,newunbecomes the pool address. - Every later call hits
require(to != newun, "please wait");, intransferand in theelsebranch oftransferFrom. The check has no exception for the owner or any other address. - A holder who sells through a router approves it and the router calls
transferFrom(holder, pool, tokens). Ifnewunis the pool,to == newunand the call reverts, while transfers to any other address still work. transfernewun(address _newun)isonlyOwner, so the owner can movenewunto an unused address (lifting the block) or back to the zero address (the nexttransferFromthen stores a new recipient). Which of these was ever done is not shown by the code.
The same code pattern is described, for other BNB Smart Chain tokens, as a way of blocking sells into the liquidity pool by an independent write-up; that write-up does not name this token, and no transaction for this token was opened, so what happened to holders is not established here.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address BscScan verified source for 0x2eccaf09e4a8e77cac8b8daf68637e111bad31a7 bscscan.com
- analysis Scam explained: BSC stealthy LP block (cryptot3ddybear blog) cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x2eccaf09e4a8e77cac8b8daf68637e111bad31a7 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.