ShibaElonMars Honeypot

What happened

ShibaElonMars (SEM) at 0x874506cb…e0941e is a BNB Smart Chain token whose code blocks transfers into one stored address, which in a normal pool setup is the liquidity pair. The first transferFrom call from a non-zero address writes its recipient into newun, and every later transfer or transferFrom to that address reverts with "please wait". Buying from the pair still works, while selling, which moves tokens into the pair, fails.

De.Fi's REKT database lists the token as an exit scam/honeypot in which the owner could disable the transfer function and stop users from selling.

How it happened

1. The deployer becomes owner and receives the whole supply (balances[owner] = _totalSupply;, 1000000000000000 units with decimals = 0).
2. The variable newun starts at the zero address. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first such call. When liquidity is added through a router, that recipient is the trading pair.
3. After that, transfer runs require(to != newun, "please wait"); and transferFrom takes the else require(to != newun, "please wait"); branch. A sell through a router calls transferFrom(holder, pair, amount), so it reverts before balances[from] is reduced and the holder keeps their tokens but cannot exit through the pair.
4. Buys are transfers from the pair to the buyer (to is the buyer, not newun), so they succeed, as do wallet-to-wallet transfers. The pair is the only destination that is blocked.
5. transfernewun(address _newun) is onlyOwner and overwrites newun. Pointing it at an unused address lifts the block; setting it to the zero address would let the next transferFrom capture a new recipient. The contract has transferOwnership/acceptOwnership but no renounce function. No transaction showing the owner calling transfernewun was opened, so what the owner actually did is not established here.
6. clearCNDAO() lets the owner send the contract's own BNB balance to themselves (_owner.transfer(address(this).balance);); it does not touch token balances or pool liquidity.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SEM

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source for ShibaElonMars (SEM) 0x874506cba7e8050a5291b9dbba83f5f2a7e0941e bscscan.com
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
• analysis Sourcify match for chain 56 contract 0x874506cba7e8050a5291b9dbba83f5f2a7e0941e repo.sourcify.dev