What happened
SkyRocket's token code contains a transfer lock keyed to a stored address called newun. The first transferFrom call records its recipient as newun, and from then on any transfer or transferFrom whose recipient is that address reverts with "please wait". If the recorded address is the liquidity pair, holders can buy but cannot sell back to it.
The function that could change newun is restricted to address(1), so as written no ordinary account can reset it. De.Fi's REKT database lists SkyRocket as an Exit Scam/Honeypot on BNB Chain dated 2021-05-27 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The listing gives no loss figure.
How it happened
- The constructor mints the entire supply (
_totalSupply = 1000000000000000000000000000000000) to the deployer:balances[owner] = _totalSupply;. - In
transferFrom, the first call by anyfrom != address(0)whilenewunis empty stores its recipient:if(from != address(0) && newun == address(0)) newun = to;. That call is not blocked. - Every later call hits the other branch:
else require(to != newun, "please wait");.transfercarries the same check,require(to != newun, "please wait");. Any transfer whose recipient equalsnewunreverts. - If the first
transferFromrecipient was the liquidity pair (the pattern the cited Cryptot3ddybear write-up describes for this template, where the address is stored during the add-liquidity transaction), a holder's swap, which pulls tokens into the pair throughtransferFrom(holder, pair, amount), reverts. Buys, where the pair sends tokens out, do not touch the check. The code alone does not show which addressnewunholds on-chain. - The reset function
transfernewunis guarded by a secondonlyOwnermodifier defined inTokenBEP20:modifier onlyOwner() {require(msg.sender == address(1));_;}. This overrides theOwnedversion, sotransfernewunandclearCNDAO(which would send the contract's BNB balance to the caller) can only be called fromaddress(1). As written, nobody can lift the lock through the contract. Whether any holder actually failed to sell is not shown by an opened transaction; the listing states the sell restriction.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
