Safecare Honeypot

What happened

Safecare ($CARE) is a BEP-20 token on BNB Chain, deployed from 0x1de229AF…E0727f in transaction 0xb2fb669f…7a8d3c. De.Fi's REKT database lists it as an Exit Scam/Honeypot: the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows how: a stored address, newun, that cannot receive tokens through transfer or transferFrom, and which the owner can overwrite at any time.

The code allows this block; the listing gives no loss figure.

How it happened

1. The contract stores a public address newun and reverts any move of tokens to it: require(to != newun, "please wait"); in transfer, and else require(to != newun, "please wait"); in transferFrom.
2. newun is not set in the constructor. The first transferFrom call where it is still empty runs if(from != address(0) && newun == address(0)) newun = to;, which stores that call's recipient as newun and lets the transfer go through. A blog post analysing this code pattern describes the first liquidity addition as the call that captures the pool address; this contract's code does not name the pool, so which address was captured is not shown by the source alone.
3. From then on, any transferFrom whose to equals newun fails with "please wait". A swap that sells tokens pulls them with transferFrom into the pool, so if the pool is the stored address, sells revert while buys (tokens leaving the pool) still work.
4. The owner can also change the block by hand: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to zero lets the next transferFrom capture a new recipient; pointing it at an unused address lifts the block.
5. clearCNDAO() is onlyOwner and sends address(this).balance, the native coin held by the token contract, to the owner. It does not touch liquidity-pool funds. The contract has no renounceOwnership; ownership moves only through the two-step transferOwnership and acceptOwnership.
6. Whether liquidity was withdrawn or how many holders were unable to sell is not shown by the code or by the sources opened; De.Fi's REKT database lists the token as an Exit Scam/Honeypot without a loss figure.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract CARE

Evidence

• report @Token_Sniffer incident report twitter.com
• address Safecare ($CARE) verified source on BscScan bscscan.com
• analysis Safecare ($CARE) Sourcify match repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io