What happened
Papito ($PAPITO) is a BEP-20 token on BNB Chain built on a known "stealthy LP block" honeypot template. The first transferFrom call, which in practice is the owner adding PancakeSwap liquidity, silently stores its recipient (the liquidity pair) in the variable newun. After that, every transfer or transferFrom whose recipient is newun reverts with please wait.
Buying still works because the pair sends tokens out. Selling does not, because a sale sends tokens into the pair. The owner can repoint or clear newun at any time with transfernewun.
De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor mints the whole supply to the deployer (
owner). newunstarts as the zero address. The firsttransferFromfrom a non-zero address setsnewun = to, and this call does not revert. When the owner adds liquidity through PancakeSwap, the router'stransferFrommoves tokens into the pair, so the pair becomesnewun.- Buyers receive tokens through
transfercalls made by the pair, which pass because the recipient is notnewun. - A holder's sale sends tokens to the pair through
transferFromortransfer, andrequire(to != newun, "please wait")reverts it. - The owner can call
transfernewunto setnewunto any address, including zero, which reopens transfers to the pair until the nexttransferFromsets it again. The owner can also withdraw any BNB held by the contract withclearCNDAO.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
