SafeNaruto Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SafeNaruto Token (SafeNARUTO) is a token on BNB Smart Chain whose _transfer calls calculateFeesBeforeSend, which reverts with "Error: Can not sell this token" whenever the recipient is flagged in the PanCakeSwapReciever mapping. Only the owner can flag addresses, through setPanCakeSwapReciever, and the function accepts any non-zero address with no limit. Sending tokens to a flagged address, for example a trading pair, therefore fails, while transfers to unflagged addresses continue to work.

De.Fi's REKT database lists the token as an exit scam/honeypot and says the owner could disable the transfer function, which restricted users from selling. The code shows how a sale can be blocked; no transaction was opened that shows the owner flagging any address.

How it happened

  1. Ownable's constructor sets _owner = _msgSender(); and the SafeNaruto constructor mints the whole supply to the deployer with _transferTO(msg.sender, 900000000000e18);.
  2. Every transfer and transferFrom goes through _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount).
  3. calculateFeesBeforeSend contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The mapping defaults to false for every address, so nothing is blocked until an address is flagged.
  4. The owner can flag any non-zero address with setPanCakeSwapReciever(address _recipient, bool _feeless); unlike the fee-less setters, it is not gated by canWhitelist. A holder sending tokens to a flagged address, such as a pair, hits the revert, and the whole transaction is undone, so the holder's balance is not debited. The check is on the recipient only, and the owner can flag or unflag at any time.
  5. renounceWhitelist() only sets canWhitelist = false, which stops new fee-less entries but does not affect setPanCakeSwapReciever. The contract does include renounceOwnership(); an on-chain read on 2026-09-30 returned owner 0xc8e36a11…dfee9a, so the owner role was still set at that time.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SafeNARUTO

Evidence

Same attack technique

Browse all hacks →
Ethereum CoreSwap.finance Loss not disclosed Ethereum GoalTimeN Finance Loss not disclosed Ethereum Cook Token Loss not disclosed BNB Chain MoonX2 Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes