Safe Sex Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Safe Sex (SAFESEX) is an Ethereum token with an address variable newun that, once set, makes every transfer to that address revert with "please wait". The first transferFrom call made while newun is empty stores its recipient there, which is how a liquidity deposit would mark the pool, and the owner can also set it directly with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-24, saying the owner could disable the transfer function, which restricted users in selling their tokens.

The listing gives no loss amount, and the code alone does not show which address newun held or whether any holder was blocked.

How it happened

  1. newun is a public address that starts as zero; transfernewun(address _newun) lets the owner overwrite it with any address, including zero.
  2. In transferFrom, the first line is if(from != address(0) && newun == address(0)) newun = to;. The first transferFrom made while newun is zero therefore stores that call's recipient in newun and does not revert. If that call is a liquidity deposit, newun becomes the pool address. The code does not show who to was.
  3. After that, transferFrom takes the else require(to != newun, "please wait"); branch and transfer runs require(to != newun, "please wait");. Any transfer into the stored address reverts for every caller, so a sell through a router (transferFrom into the pool) fails and the holder's balance is not debited. Tokens leaving that address, such as a buyer's purchase, hit no such check.
  4. The block can be lifted or re-armed by the owner: transfernewun pointed at an unused address ends it, while setting it to zero re-arms capture, so the next transferFrom stores a new recipient. Nothing in the contract changes owner except the transferOwnership/acceptOwnership pair.
  5. The source header comment says "100% RUG FREE" and "100% LIQUIDITY LOCK ON UNICRYPT", but the contract contains no liquidity-lock logic, and the code cannot show who holds the LP tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SAFESEX
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum UnoRe Loss not disclosed Ethereum Monkey Island Loss not disclosed BNB Chain Atmosphere Loss not disclosed Ethereum Golden Retriever Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes