What happened
POOL SIDE DAO (POOLS) is a BEP-20 token on BNB Chain advertised in its source comment as a fair-launch community token. The code contains a hidden variable newun: the first transferFrom from a non-zero address stores its recipient there, and when liquidity is added through the PancakeSwap router that recipient is normally the liquidity pair. After that, every transfer or transferFrom whose destination is newun reverts with please wait, so holders can buy from the pool but cannot sell into it.
The owner can repoint newun at any time with transfernewun. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor credits the full supply of
20000000000000000000000raw units (20,000 POOLS at 18 decimals) to the owner. - The first
transferFromwith a non-zero sender runsif(from != address(0) && newun == address(0)) newun = to;. When the router adds liquidity, it pulls tokens withtransferFrominto the PancakeSwap pair, so the pair can becomenewun. - Buying still works, because the pair sends tokens out to buyers and only transfers *to*
newunare checked. - A sale sends tokens to the pair, so both
transferandtransferFromhitrequire(to != newun, "please wait")and revert. - The owner can call
transfernewunto pointnewunelsewhere, which would reopen sells to the pair, and can later set it back.clearCNDAOlets the owner withdraw any BNB held by the token contract.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address POOL SIDE DAO (POOLS) verified contract source, BscScan bscscan.com
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap cryptot3ddybear.gitlab.io
- analysis Sourcify match, chain 56, 0x8db74b907a18234acd2c9272fe19d3588654eca9 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
