SafeMcDc Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

The token blocks every transfer whose recipient equals a stored address called newun. newun starts empty and is filled by the first transferFrom call whose sender is not the zero address, taking that call's recipient. If that recipient is the liquidity pair, which is what happens when liquidity is added through a router, every later sell into the pair reverts with "please wait", while buys out of the pair are not checked.

The owner can also rewrite newun at any time with transfernewun. De.Fi's REKT database lists this token as an Exit Scam/Honeypot, saying the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor mints the whole supply to the deployer: balances[owner] = _totalSupply; (10,000,000,000 tokens at 18 decimals). newun is left at the zero address.
  2. The first transferFrom call with a non-zero sender while newun is empty runs if(from != address(0) && newun == address(0)) newun = to;. That call is not checked and succeeds, and newun now holds its recipient. If the recipient was the liquidity pair, the pair is now the blocked address; the code alone does not show which address was stored.
  3. From then on transfer starts with require(to != newun, "please wait"); and transferFrom runs else require(to != newun, "please wait");. Any transfer whose recipient is newun reverts, so a holder selling into a pair stored as newun cannot complete the swap.
  4. Nothing in either function checks from, so tokens can still leave newun. Transfers out of a pair stored there (buys) are not blocked.
  5. transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Setting it to the zero address re-arms the capture by the next transferFrom; pointing it at an unused address lifts the block. The contract has no renounce function, only the two-step transferOwnership and acceptOwnership.
  6. Separately, clearCNDAO is onlyOwner and runs _owner.transfer(address(this).balance);, sending any BNB held by the token contract itself to the owner. This is not the pair's liquidity.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Safe McDonalds Coin

Evidence

Same attack technique

Browse all hacks →
BNB Chain SafeAndromeda Loss not disclosed Ethereum Polkamon.com Loss not disclosed BNB Chain unimex Loss not disclosed BNB Chain Gundam Finance BSC Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes