PROTOCOL PENA Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

PROTOCOL PENA (PENA) is a BEP-20 token on BNB Smart Chain at 0xd74c5846…02a1d6, deployed in transaction 0x60c17e91…42c982. De.Fi's REKT database lists it as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling. In the verified source the restriction is a single stored address, newun: both transfer and transferFrom revert when the recipient equals it, and the first transferFrom made while it is still unset writes that call's recipient into it.

The owner can also repoint it with transfernewun. The sources opened do not include a transaction showing holders being blocked.

How it happened

  1. The constructor mints the whole supply (_totalSupply = 20000000000000000000000, 20,000 tokens at 18 decimals) to the deployer, who becomes owner, and leaves newun as the zero address.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from while newun is unset does not revert and stores its own recipient in newun. Liquidity added through a router pulls tokens with transferFrom, so the recipient of that first call would be whatever address receives the tokens; the source does not say which address that was for this token.
  3. From then on transfer runs require(to != newun, "please wait"); and transferFrom runs the same check, so any movement of tokens to the stored address reverts for every sender, including holders. A holder's balance is only debited after these checks, so a blocked transfer leaves the balance in place but unsellable to that address.
  4. A swap that sells the token into a pool sends the holder's tokens to the pool through transferFrom. If the pool is the stored newun, that sale reverts with "please wait". Buying is a transfer out of the pool, which the check does not touch.
  5. The owner can call transfernewun(address _newun) at any time. Pointing it at an unused address lifts the block; setting it back to the zero address lets the next transferFrom with a non-zero from capture a new recipient. Nothing in the source removes this power, and the contract has transferOwnership/acceptOwnership but no renounce function.
  6. Separately, clearCNDAO() lets the owner send the token contract's own BNB balance to themselves. That is the contract's balance, not a liquidity pool's.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PENA

Evidence

Same attack technique

Browse all hacks →
BNB Chain MOON FARM Loss not disclosed BNB Chain SafeSushi Loss not disclosed Ethereum Uniswap-V3 Loss not disclosed BNB Chain Dextrarius Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes