REFERRALPROJECT.NETWORK Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

REFERRALPROJECT.NETWORK (REFER) is a BNB Chain token deployed on 26 March 2021 at 0xf74e12b9…05a587. Its contract keeps a hidden target address, newun: the first transferFrom made while newun is empty stores that call's recipient, and from then on every transfer or transferFrom to newun reverts with "please wait". When the first transferFrom is the router moving the owner's tokens into a new PancakeSwap pair, the pair becomes newun, so every sale into the pool fails while purchases paid out of the pool still work.

Only the owner can point newun somewhere else, through transfernewun. De.Fi's REKT database lists REFER as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling their tokens.

How it happened

  1. The constructor mints the full 295,000 REFER supply to the deployer, who becomes owner, and leaves newun as the zero address.
  2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to;, so the recipient of the first transferFrom becomes newun. When the owner adds liquidity through the PancakeSwap router, the router's transferFrom into the pair is that first call.
  3. Every later transferFrom runs require(to != newun, "please wait"), and transfer runs the same check. A router sale moves the holder's tokens to the pair, so it reverts.
  4. Purchases move tokens from the pair to the buyer, whose address is not newun, so buying keeps working.
  5. The owner-only transfernewun(address) can reset newun to any address, which is the only way to reopen sales.
  6. The contract also has an owner-configured presale, tokenSaleREFER, that accepts BNB, and the owner-only clearDOG() sends the contract's whole BNB balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract REFER

Evidence

Same attack technique

Browse all hacks →
BNB Chain SpaceDEFI Loss not disclosed BNB Chain OMNI Loss not disclosed BNB Chain Q DAO Governance token v2.0 $3K lost BNB Chain Tripod Dao Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes