Olympus Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

This Olympus (Olympus) token is a BEP-20 token on BNB Chain, unrelated to OlympusDAO, that blocks every sale into its liquidity pool. The first transferFrom the contract sees, normally the PancakeSwap router pulling the owner's tokens into the new pair when liquidity is added, stores that recipient in a variable named newun. After that, both transfer and transferFrom revert with please wait whenever the recipient is newun, so holders can buy from the pool but cannot sell back into it.

The owner can repoint newun at any time with transfernewun. The same newun trap was documented in April 2021 in BNB Chain tokens such as SafeRocket; De.Fi's REKT database lists this Olympus token as an exit scam/honeypot, with no loss figure.

How it happened

  1. The constructor credits the whole supply, 10000000000000000000 raw units (100,000,000,000 Olympus at 8 decimals), to the owner; newun starts as address(0).
  2. When liquidity is added through the PancakeSwap router, the router calls transferFrom(owner, pair, amount). Because newun == address(0), the line if(from != address(0) && newun == address(0)) newun = to; records the pair as newun and lets that first transfer through.
  3. Buys still work: the pair sends tokens to the buyer with transfer, and the buyer is not newun.
  4. A sell sends tokens to the pair, through the router's transferFrom or a direct transfer. Both check require(to != newun, "please wait"), so every sell reverts with a message that suggests a temporary delay.
  5. transfernewun(address _newun) is onlyOwner, so the owner can move the block to another address, which would reopen sells, or reset it to zero so the next transferFrom recipient is blocked instead.
  6. Removing liquidity sends tokens out of the pair rather than into it, so the block does not stop whoever holds the LP tokens from withdrawing the pool's BNB.
  7. clearCNDAO() lets the owner withdraw any BNB held by the token contract itself. There is no renounceOwnership; ownership changes only when a new address calls acceptOwnership after transferOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Olympus

Evidence

Same attack technique

Browse all hacks →
Ethereum Baby Doge Coin Loss not disclosed Ethereum Whackd Loss not disclosed BNB Chain ChildDoge Loss not disclosed BNB Chain Papito Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes