PAIRS Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists this token as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling. The verified source has no all-transfers switch. Its control is an address variable, newun, that transfer and transferFrom use as a blocked recipient: any call whose recipient equals newun reverts with "please wait".

If newun points at the liquidity pair, a sale (a transfer into the pair) reverts while a purchase out of the pair still passes. The owner can set newun at any time with transfernewun, and the first transferFrom made while newun is unset also sets it to that call's recipient. The source header advertises "10% FEES PER TRANSACTION", but the transfer functions move the full amount with no fee logic.

The contract is at 0x7f0f6ab1…3b901e on BNB Smart Chain.

How it happened

  1. The deployer becomes owner (owner = msg.sender;) and receives the whole supply in the constructor (balances[owner] = _totalSupply;).
  2. newun starts as the zero address. The owner can set it to any address at any time: function transfernewun(address _newun) public onlyOwner { newun = _newun; }.
  3. Every transfer call rejects a recipient equal to newun: require(to != newun, "please wait");. The check is on the recipient only, so it applies to every sender, including the owner.
  4. transferFrom has two branches: if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. While newun is zero, the first call with a non-zero from skips the check and stores its recipient in newun; once newun is non-zero, every later transferFrom to that address reverts.
  5. DEX routers move a seller's tokens into the pair with transferFrom. If newun holds the pair address, sells therefore revert with "please wait", while buys (the pair sending tokens out to the buyer) are not blocked. The code does not set newun to the pair by itself; that depends on which address the owner sets, or which call reaches transferFrom first. Pointing newun at an unused address lifts the block, and setting it back to the zero address lets the next transferFrom capture a new recipient.
  6. clearCNDAO lets the owner send the contract's native balance to itself: _owner.transfer(address(this).balance);. There is no renounceOwnership; the owner can pass the role on with transferOwnership and acceptOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract $PAIR

Evidence

Same attack technique

Browse all hacks →
BNB Chain Rocket Man Loss not disclosed BNB Chain PHOENIXTOKEN Loss not disclosed BNB Chain INFINITE SPACE Loss not disclosed BNB Chain NyanCat Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes