ROCKETSHOT Honeypot

What happened

ROCKETSHOT is a BEP20 token on BNB Smart Chain, 0xa81a560a…d69292, deployed in transaction 0x484c8b08…4e206c on 2021-04-13. De.Fi's REKT database lists it as an Exit Scam/Honeypot. The code keeps a newun address and reverts any transfer or transferFrom whose recipient is that address with the message "please wait".

newun is filled automatically by the first transferFrom call (with a non-zero from) and the owner can also set it with transfernewun. If newun holds a liquidity pair, any sale that sends tokens to the pair reverts while buys out of the pair are not blocked.

How it happened

1. The constructor sets balances[owner] = _totalSupply; with _totalSupply = 1000000000000000000000000000000000 (10^15 tokens at 18 decimals), so the deployer starts with the whole supply. The header comment advertises a 10% tax (5% burn, 5% to holders), but transfer and transferFrom move the full tokens amount and apply no fee.
2. address public newun; is zero at deployment.
3. The first transferFrom with a non-zero from while newun is zero stores the recipient: if(from != address(0) && newun == address(0)) newun = to;. That call skips the require, so it goes through.
4. From then on both entry points reject a recipient equal to newun: require(to != newun, "please wait"); in transfer, and else require(to != newun, "please wait"); in transferFrom. No sender is exempt, the owner included.
5. If the first transferFrom recipient was the liquidity pair (the pattern the cited blog post describes for other tokens; the code alone does not say which address newun holds here), a router sale, which ends in a transferFrom to the pair, reverts. Transfers from the pair to a buyer have a different recipient and pass.
6. The owner can re-point the block with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address makes the next transferFrom capture a new recipient again; pointing it at an unused address lifts the block. The contract also has clearCNDAO, which sends the contract's own BNB balance to the owner. De.Fi's listing gives no loss figure, and no transaction was opened to show what happened to liquidity.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ROCKETSHOT

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing (proof tweet, returned 404) twitter.com
• address BscScan verified source for ROCKETSHOT bscscan.com
• analysis Sourcify copy of the ROCKETSHOT contract repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear, lead from TokenSniffer) cryptot3ddybear.gitlab.io