Rainicorn Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists Rainicorn (RAINI) on BNB Smart Chain as an exit scam / honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. The verified source shows the mechanism: a storage variable newun holds a single blocked recipient address, and both transfer and transferFrom revert with "please wait" when the recipient equals it. The first transferFrom call made while newun is unset sets newun to its recipient, which is the address that receives tokens during the first liquidity addition if that call goes through transferFrom.

After that, any sale that moves tokens to that address reverts, while transfers out of it are not restricted by this check. The owner can also change newun with transfernewun.

How it happened

  1. The constructor mints the full _totalSupply of 10000000000000000000000000000 raw units (10 billion tokens at 18 decimals) to the deployer: balances[owner] = _totalSupply;.
  2. The contract keeps an extra public variable newun that is not part of any standard BEP20 token: address public newun;. It starts as the zero address.
  3. The first transferFrom executed while newun is zero stores its recipient in newun: if(from != address(0) && newun == address(0)) newun = to;. Pulling tokens into a liquidity pool through a router is a transferFrom to the pair, so in that flow the pair address would be captured. The source does not show which address was captured on chain.
  4. From then on, every transferFrom takes the other branch: else require(to != newun, "please wait");. In transfer the same check runs unconditionally: require(to != newun, "please wait");. Neither function has an exemption for the owner or any other address, so no one can send tokens to the captured address.
  5. Buying is not blocked by this check: the pair calls transfer with the buyer as recipient, and the buyer is not newun. Selling moves tokens to the pair, which is newun if the pair was captured, so the sale reverts with "please wait".
  6. The owner controls the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting newun to an unused address lifts the block; setting it to the zero address re-arms capture on the next transferFrom. The contract also exposes clearCNDAO(), which lets the owner send the contract's own native-coin balance to the owner. Ownership can only move through transferOwnership and acceptOwnership; there is no renounceOwnership.
  7. What happened: De.Fi's REKT database classifies the token as an exit scam / honeypot listed for 2021-08-29 with no loss amount. No transaction was opened showing which address newun held or when the owner called transfernewun.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract RAINI

Evidence

Same attack technique

Browse all hacks →
Ethereum element.fi Loss not disclosed BNB Chain E-Coin Loss not disclosed BNB Chain ELON INU Loss not disclosed BNB Chain XSPACE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes