What happened
REAPit (REAP) is a BEP-20 token on BNB Chain at 0x324ba9e9…970e14, deployed on 28 March 2021 by 0x4aA400BD…8B730d, which received the full 100,000,000 REAP supply and is still the on-chain owner. De.Fi's REKT database lists it as an exit scam/honeypot. The verified source has no general on/off switch for transfer.
Instead, the first transferFrom call, which is normally the router adding liquidity, silently saves the destination (the PancakeSwap pair) in a variable named newun. After that, every transfer to that address reverts with "please wait", so holders can buy from the pool but cannot sell into it, and the owner can repoint newun at any time with transfernewun.
How it happened
- The constructor gives the whole supply to the deployer:
balances[owner] = _totalSupply;. - When liquidity is added, the router pulls tokens with
transferFrom. Becausenewunis still empty, this line stores the destination:if(from != address(0) && newun == address(0)) newun = to;. The destination is the PancakeSwap pair. - Buyers receive REAP from the pair through
transfer, which only rejects transfers whose destination isnewun, so buys succeed. - A sale sends tokens to the pair. Both paths check the destination:
transferhasrequire(to != newun, "please wait");andtransferFromrunselse require(to != newun, "please wait");, so every sell reverts. - The owner can change the blocked address with
function transfernewun(address _newun) public onlyOwner, which can unblock the pair for chosen moments or block another address.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- transaction REAPit contract creation transaction bscscan.com
- address ReapitBEP20 verified source code bscscan.com
- analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x324ba9e940f3f2a2de6768a7c80b847b8b970e14 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
