What happened
De.Fi's REKT database lists SafeWorld (SAFEworld) on BNB Smart Chain as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function and so stop users selling. In the verified source at 0x8222f0c4…50e523 the control is a per-address flag: the owner can call setPanCakeSwapReciever(address, bool) for any address, and calculateFeesBeforeSend then reverts every transfer whose recipient is flagged with Error: Can not sell this token. Because the revert happens after the sender's balance is debited inside _transfer, the whole transaction is undone and the holder keeps the tokens.
The code also exposes a txFee setter capped at 100 but never applies it. The code shows how sales to a chosen address can be blocked; no transaction showing a blocked sale was opened for this record.
How it happened
- The constructor mints 150,000,000 tokens to the deployer with
_transferTO(msg.sender, 150000000e18);, and the deployer becomes owner throughOwnable. - The owner can mark any address as a blocked recipient with
function setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner { ... PanCakeSwapReciever[_recipient] = _feeless; }. The function name suggests an exchange address, but the code does not say which address is flagged. - Every
transferandtransferFromgoes through_transfer, which first debits the sender (_balances[sender] = _balances[sender].sub(amount, ...)) and then callscalculateFeesBeforeSend(sender, recipient, amount). - If the recipient is flagged,
calculateFeesBeforeSendrunsif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The revert undoes the debit, so the sender's balance is unchanged and the transfer fails. For any unflagged recipient it returns(amount, 0)and the transfer completes with no fee. - The owner can set the flag back to
falsefor the same address, so the block can be switched on and off. The contract also hasrenounceOwnership(), so the owner could give up this power; the code does not show whether that happened. seTxFeeonly storestxFee(the require message readsFees cannot go above 10%but the check is_ff <= 100), andcalculateFeesBeforeSendreturns a fee of 0 whatevertxFeeholds, so the fee setting has no effect on transfers.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
