SAFESHITCOIN Honeypot

What happened

SAFESHITCOIN (SFSHITCOIN) is a BNB Chain token whose transfer functions refuse any transfer to one stored address, newun. The first transferFrom call made while newun is empty stores its recipient in newun, and from then on every transfer or transferFrom to that address reverts with "please wait". The owner can also overwrite newun with transfernewun.

A DEX sell is a transfer to the pair contract, so if the stored address is the pair, holders cannot sell. De.Fi's REKT database lists SFSHITCOIN as an Exit Scam/Honeypot in which the owner could restrict users from selling.

How it happened

1. The constructor mints _totalSupply = 100000000000000000000000 (8 decimals) to the deployer, who becomes owner.
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call that reaches this line while newun is empty stores the recipient in newun and is allowed through. The security write-up of this pattern says that first call is the liquidity add, so newun becomes the PancakeSwap liquidity pool address.
3. From then on, transferFrom reverts for any recipient equal to newun, and transfer starts with require(to != newun, "please wait");. A swap that sends tokens from a holder to that address reverts.
4. transfernewun(address _newun) public onlyOwner lets the owner replace newun. Pointing it at an unused address lifts the block; setting it to the zero address makes the next transferFrom capture a new recipient.
5. Buying is not blocked by this check: tokens leaving the pool go to a holder, who is not newun.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SFSHITCOIN

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing for SFSHITCOIN (as supplied in meta.json) twitter.com
• address BscScan verified source: SAFESHITCOIN bscscan.com
• analysis Sourcify repository copy of the same contract repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io