MASKSWAP Honeypot

1. newun starts as the zero address. In transferFrom, the first call with a non-zero from assigns it without any restriction: if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. That call is not owner-gated, so newun becomes whatever recipient the first transferFrom names. The code does not say which address that was.
2. Afterwards every call to transferFrom reaches the else branch, and transfer has its own check, require(to != newun, "please wait");. A transfer to newun reverts, so the sender's balance is not debited. The check tests the recipient only; it does not exempt the owner.
3. A swap that moves tokens from a holder to a liquidity pair uses transferFrom with the pair as the recipient. If the pair is the address stored in newun, that sell reverts. The code alone does not show whether newun is the pair.
4. The owner can change the target at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address re-arms the capture by the next transferFrom; pointing it at an unused address lifts the block for the pair.
5. Separately, clearCNDAO is onlyOwner and sends the contract's own native balance to the owner (_owner.transfer(address(this).balance)); the contract accepts native coin through its payable fallback. This is not a liquidity withdrawal path.

This describes what the code allows. No transaction in the evidence shows which address newun held or whether any sale failed.