SafePancake Honeypot

What happened

SafePancake is a BEP20 token on BNB Smart Chain whose transfer functions refuse to send tokens to a stored address called newun. That address is filled in automatically by the first transferFrom call made while it is empty, and the owner can also overwrite it with transfernewun. Whatever address newun holds can receive no tokens through transfer or transferFrom, and the contract's revert text is 'please wait'.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the owner could restrict users from selling; it gives no loss figure.

How it happened

1. The constructor mints the full supply (_totalSupply = 1000000000000000000000000000000000, 18 decimals) to the deployer, which is also owner.
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom made while newun is empty therefore succeeds and stores its recipient to in newun. The stored address is whichever recipient that first call paid; the code does not say which address that was for this token.
3. From then on every transferFrom whose recipient is newun fails the require, and transfer has the same check (require(to != newun, "please wait");). If newun is a liquidity pool, a holder's sale into it reverts, while transfers to other addresses still work. Whether newun held the pool address was not checked on-chain here.
4. The owner can change the block at any time with transfernewun(address _newun) public onlyOwner. Setting it to an unused address lifts the block; setting it to address(0) re-arms capture, because the next transferFrom while newun is empty stores its recipient again.
5. The seed blog post (2021-04-11) describes this newun pattern in other tokens as blocking sales back through the PancakeSwap pool. The contract also has clearCNDAO(), which lets the owner send any BNB held by the token contract to itself.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SafePancake

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, SafePancake bscscan.com
• analysis Sourcify match, chain 56, 0xf6299d6f34b851474d8b0f95b47ae3081c49a704 repo.sourcify.dev
• analysis De.Fi REKT database listing for SafePancake de.fi
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear blog, 2021-04-11) cryptot3ddybear.gitlab.io