Safe Nintendo Honeypot
What happened
Safe Nintendo (SFNINTENDO) is a BNB Chain token deployed on 14 April 2021 at 0xd5d0bcd6…8192f2. A comment at the top of the source advertises an NFT game, 3% reflections to holders and 3% auto-liquidity, but the contract contains no fee logic; instead, its internal _approve function only stores an allowance when the approving address is the hard-coded deployer 0xF576f0dD…acFd2D and stores zero for everyone else. A PancakeSwap sale needs the router to move the holder's tokens with transferFrom, which then fails the allowance check, so holders can buy but not sell through the router, while the deployer's own approvals work.
The owner can also mint any amount of SFNINTENDO to itself. De.Fi's REKT database lists Safe Nintendo as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.
How it happened
- The constructor mints 1,000,000,000,000 SFNINTENDO (8 decimals) to the deployer.
- When a holder approves the PancakeSwap router, the
approvecall succeeds, but_approvechecksif (owner == address(0xF576f0dDe6b6ecaBa4f25e4AC3241B8A17acFd2D))and, for any other holder, runs_allowances[owner][spender] = 0;and emitsApproval(owner, spender, 0). - A router sale calls
transferFrom, which subtracts the amount from the zero allowance withsub(amount, "BEP20: transfer amount exceeds allowance")and reverts. - Buys use the pair's
transferto the buyer, which needs no allowance, so buying keeps working. - The hard-coded deployer address keeps normal allowances, so it can still sell through the router. The
onlyOwnerfunctionmint(uint256)can create unlimited SFNINTENDO for the owner.renounceOwnershipwould remove the mint power, but the allowance exception is tied to a fixed address, not to the owner role.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report De.Fi REKT database listing for Safe Nintendo (proof links: Token Sniffer tweet 1380219360631906307 and S4) twitter.com
- transaction Safe Nintendo contract creation transaction bscscan.com
- address Safe Nintendo verified contract code on BscScan bscscan.com
- analysis Sourcify match for 0xd5d0bcd6a6685eec294c2bf1a1d4ba45788192f2 on BNB Chain repo.sourcify.dev
- analysis BSC-SCAM: PancakeSwap NoApproval cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.