One SG Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

One SG (1SG) is a BNB Smart Chain token whose transfer and transferFrom refuse any transfer to a stored address called newun. The first transferFrom call made while newun is empty stores that call's recipient as newun, which is the pattern a liquidity add through a router produces, and after that no token can be sent to it. If that address is the trading pair, sells fail with "please wait" while buys, which move tokens out of the pair, are not checked.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-28 and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor sets symbol = "1SG", name = "One SG" and mints the full _totalSupply of 20,000,000 tokens (18 decimals) to owner, the deployer.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. While newun is still empty, the first transferFrom whose from is non-zero stores its recipient in newun and skips any check. A router-based liquidity add calls transferFrom with the pair as to, so the pair would be stored. The code does not name the pair, so this is how the code behaves, not proof of which address was stored.
  3. Every later transferFrom takes the else branch, else require(to != newun, "please wait");, and transfer has require(to != newun, "please wait");. Any transfer whose recipient is newun reverts.
  4. A holder selling through the router makes the router call transferFrom(holder, pair, tokens). If newun is the pair, to == newun and the sell reverts. A buy sends tokens from the pair to the buyer with to set to the buyer, which passes.
  5. The owner can call transfernewun(address _newun) at any time to change newun. Setting it to the zero address lets the next transferFrom capture a new recipient; pointing it at an address that never receives tokens lifts the block. clearCNDAO() also lets the owner send the contract's own BNB balance to themselves; it does not touch token balances.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract 1SG

Evidence

Same attack technique

Browse all hacks →
BNB Chain SafeFLM Loss not disclosed BNB Chain ELONFLY Loss not disclosed BNB Chain SolaceToken Loss not disclosed BNB Chain SafeTeslaCoil Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes