SAFEMYANMAR Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists SAFEMYANMAR (BNB Chain contract 0x77c94558…becedc) as an exit scam/honeypot dated 2021-03-28, saying the owner could disable the transfer function and so stop users selling. The verified source does not switch transfers off; it stores one address in newun that cannot receive tokens, and the first transferFrom fills that slot with whatever recipient it names. A blog post linked by the listing describes this same code pattern as a stealthy liquidity-pool block, where the stored address is the pool and sells therefore revert.

The owner can also overwrite newun through transfernewun. These are what the code allows; no transaction for this token was opened.

How it happened

  1. The constructor mints the full supply, 1,050,000,000,000 tokens with 18 decimals (_totalSupply = 1050000000000000000000000000000), to the owner. newun starts as the zero address.
  2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from stores its recipient in newun and proceeds, with no check on who calls or who the recipient is.
  3. After that, transferFrom takes the else branch and transfer runs require(to != newun, "please wait"), so any transfer whose recipient equals newun reverts. The holder's balance is not debited, because the subtraction balances[from] = balances[from].sub(tokens) comes after the check.
  4. If newun is a trading pool, which is the case the linked blog post describes for this pattern, buyers can still receive tokens from the pool through transfer, but a sale sends tokens to the pool and reverts with please wait. The code does not show which address newun holds for this token.
  5. The check has no owner exemption, but the owner controls the slot: transfernewun(address _newun) is onlyOwner and writes newun = _newun. Setting it to the zero address lets the next transferFrom capture a new recipient; setting it to an unused address lifts the block.
  6. There is no renounceOwnership; ownership moves only through transferOwnership and acceptOwnership. clearCNDAO is also onlyOwner and sends the token contract's own BNB balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SAFEMYANMAR

Evidence

Same attack technique

Browse all hacks →
BNB Chain SafeSuperHeavy Loss not disclosed Ethereum Rage.Fan Loss not disclosed Ethereum Polkalokr Loss not disclosed Ethereum Fei protocol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes