SafeDream Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SafeDream (BNB Chain contract 0xaee4e249…3583c4) is a BEP-20 token whose transfer and transferFrom both refuse to deliver tokens to one stored address, newun. transferFrom fills newun with the recipient of the first call made while it is empty, so a router liquidity deposit would record the trading pair, and from then on a router sell, which delivers the holder's tokens to the pair, reverts with "please wait". Only the owner can overwrite newun, through transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens; no sell transaction, pool address or loss figure was opened to confirm what happened on-chain, and the verified source ends with a comment reading that the tokens were generated for testing purposes.

How it happened

  1. newun is declared as address public newun; and is not assigned in the constructor, so it starts as the zero address. The constructor mints the whole supply, 10^33 base units (10^15 tokens at 18 decimals), to the deployer with balances[owner] = _totalSupply;.
  2. In transferFrom, the first call with a non-zero from while newun is empty runs if(from != address(0) && newun == address(0)) newun = to;. That branch stores the recipient and skips the require. If this call is the router moving tokens into a new pool, newun becomes the pool address.
  3. Every later call hits else require(to != newun, "please wait"); in transferFrom, and transfer has require(to != newun, "please wait");. A sell through a router moves the holder's tokens to the pool with transferFrom, so to == newun and the call reverts before balances[from] = balances[from].sub(tokens); runs; the holder's balance is unchanged and the tokens simply cannot be sold into that pool.
  4. A purchase delivers tokens from the pool to the buyer, so to is the buyer, not newun, and the transfer succeeds. Buying works while selling to the pool does not.
  5. The check has no exemption for any sender, owner included. The onlyOwner function transfernewun(address _newun) can set newun to any address: pointing it at an unused address lifts the block, while setting it to the zero address re-arms the capture so the next transferFrom recipient becomes the blocked address. The contract has no renounceOwnership; ownership can only be handed to another address through transferOwnership and acceptOwnership. The source does not show whether or when these functions were called.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SafeDream

Evidence

Same attack technique

Browse all hacks →
Ethereum SolaSystem Loss not disclosed BNB Chain FLEX Loss not disclosed BNB Chain Chihuahua Taco Loss not disclosed Ethereum Step.finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes