SaintElon Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SaintElon (ELON) is a BEP20 token on BNB Smart Chain whose transfer code reverts any transfer sent to one stored address, newun. The first transferFrom call made while newun is empty stores that call's recipient there, and from then on transfer and transferFrom revert with "please wait" for that recipient. If the stored address is a trading pair, buying still works because the pair is the sender, while selling reverts because the pair is the recipient.

The owner can overwrite newun through transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the contract owner could restrict users from selling. A published write-up by CryptoT3ddyBear describes the same newun condition in other BSC tokens and does not mention SaintElon.

How it happened

  1. The constructor mints the whole supply to the deployer, who is also owner: balances[owner] = _totalSupply;.
  2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom call made while newun is empty therefore stores its recipient in newun. Which address that was on-chain is not shown by the source.
  3. After that, transfer runs require(to != newun, "please wait"); and transferFrom runs the same require. Neither has an exemption for the owner or for any other address, so every transfer to newun reverts.
  4. If newun is a liquidity pair, a buy moves tokens out of the pair to the buyer and is not affected. A sell makes the router call transferFrom(holder, pair, amount), so to equals newun and the call reverts. The balance of the holder is never debited.
  5. transfernewun(address _newun) public onlyOwner lets the owner replace newun. Pointing it at an unused address lifts the block. Setting it to the zero address re-arms the capture, and the next transferFrom stores a new recipient.
  6. What happened on-chain (which address newun held, whether holders' sells reverted, whether liquidity was removed) is not established by the opened sources. De.Fi's REKT database lists the token as a honeypot.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ELON

Evidence

Same attack technique

Browse all hacks →
Ethereum Wu-Tang Financial Loss not disclosed Ethereum Diamond Hands Inu Loss not disclosed BNB Chain DogeMilf Loss not disclosed BNB Chain TokenFox Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes