SPEEDDAO Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists SPEEDDAO (SPDAO) on BNB Smart Chain as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source the restriction is a newun address: transfer and transferFrom both revert with "please wait" when the recipient equals newun, so no holder can send tokens to that address. newun is set by the first transferFrom call, to that call's recipient, and the owner can change it at any time with transfernewun.

The code does not name which address ends up in newun; if it is the liquidity pair, sales to it revert. The source shows what the owner can do; it does not show which values were set.

How it happened

  1. TokenBEP20 keeps a public newun address that starts as address(0). The owner can overwrite it with transfernewun(address _newun), which is onlyOwner.
  2. transfer begins with require(to != newun, "please wait");, so a direct transfer to newun always reverts, and while newun is still address(0) a transfer to the zero address reverts too.
  3. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero from therefore succeeds and records its recipient in newun, with no check on who the caller is. From then on every transferFrom whose recipient is that address reverts.
  4. The balance update happens after this check (balances[from] = balances[from].sub(tokens);), so a blocked call changes no balances. A holder's tokens stay in their wallet; only transfers whose recipient is newun fail, and the owner is not exempt from the check.
  5. If newun holds a liquidity pair address, a swap that sells the token ends in a transferFrom to the pair and reverts with the message "please wait", while transfers from the pair to buyers are not covered by the check. The source does not show whether newun was ever the pair.
  6. The owner can set newun to an address nobody uses, which lifts the block, or to address(0), which makes the next non-zero-from transferFrom store its recipient in newun again. clearCNDAO() also lets the owner send the contract's own BNB balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SPDAO

Evidence

Same attack technique

Browse all hacks →
BNB Chain SmartRush Loss not disclosed BNB Chain POOL SIDE DAO Loss not disclosed BNB Chain UBERMOON Loss not disclosed BNB Chain CrossASR Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes