STARTFI Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

STARTFI (STFI) is a BNB Smart Chain token, contract 0x1677b8a8…ec2dfd, whose transferFrom records the recipient of the first call in a variable called newun. After that, both transfer and transferFrom revert with "please wait" for any transfer to that address. If newun ends up as the liquidity pair, buying still works (the pair sends tokens out) but selling fails, because a sell moves tokens into the pair.

The owner can re-point newun at any time with transfernewun. De.Fi's REKT database lists STARTFI as an exit scam/honeypot in which the contract owner could disable the transfer function, restricting users from selling their tokens. The sources opened here do not show which address newun held on-chain or any specific holder's failed sell.

How it happened

  1. The constructor gives the whole supply to the deployer: balances[owner] = _totalSupply;.
  2. newun starts as the zero address. The first transferFrom with a non-zero from runs if(from != address(0) && newun == address(0)) newun = to;, which stores that call's recipient and skips the check. A published write-up of this pattern on BSC says the first liquidity deposit makes newun the pool address; the code alone does not show which address newun held for STFI.
  3. A buy works because the pair pays out through transfer, and transfer only checks require(to != newun, "please wait"); against the buyer's address.
  4. A sell moves tokens to the pair, either through transferFrom (else require(to != newun, "please wait");) or a direct transfer. If the pair is newun, the call reverts, so the holder's balance is not debited and the swap fails.
  5. transfernewun(address _newun) is onlyOwner and has no condition. Setting newun to an unused address lifts the block; setting it back to the zero address lets the next transferFrom capture a new recipient. The check looks only at the recipient, so it applies to every sender, including the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract STFI

Evidence

Same attack technique

Browse all hacks →
Ethereum EA Sports Token Loss not disclosed Ethereum Ethereum SHIBA Loss not disclosed BNB Chain Forest token Loss not disclosed BNB Chain dogejavu.com Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes