Step Finance Honeypot

What happened

STEP is a BEP20 token that carries a hidden sell block in its transferFrom. A variable newun starts at zero; the first transferFrom call stores its recipient in newun, and from then on every transfer or transferFrom whose recipient is newun reverts with "please wait". A security write-up on this pattern says newun captures the liquidity pool address when the owner adds liquidity, so buying works while selling back to the pool fails.

De.Fi's REKT database lists STEP as an Exit Scam/Honeypot dated 2021-05-25; no loss figure is given.

How it happened

1. The constructor sets decimals = 0; and _totalSupply = 100000000000000; and gives all of it to the deployer: balances[owner] = _totalSupply;. newun is left at the zero address.
2. In transferFrom, the first call with a non-zero from runs if(from != address(0) && newun == address(0)) newun = to;. That call is not checked against anything and simply records its recipient. The code does not name the pool; the write-up cited below describes the owner's initial liquidity add as the call that sets it, and no transaction was opened here.
3. After newun is set, transferFrom takes the else branch: else require(to != newun, "please wait");, and transfer has require(to != newun, "please wait");.
4. A router-based sale moves the holder's tokens to the pool with transferFrom(holder, pool, amount). If the pool is the stored newun, this reverts before the holder's balance is debited, so the sale fails. A buy sends tokens from the pool to the buyer, whose address is not newun, so it is not blocked by this check.
5. The owner can change the block at any time with transfernewun(address _newun) (onlyOwner). Setting it to the zero address re-arms capture on the next transferFrom; pointing it at an unused address lifts the block. owner can also transfer ownership with transferOwnership/acceptOwnership.
6. What the code allows is the block above. What happened is only that De.Fi's REKT database lists STEP as a honeypot; no sale attempt, owner call to transfernewun or victim loss was verified.

Protocol details

Classification Token

Protocol Type Portfolio Tracker

Affected asset / contract STEP

Protocol links Website @StepFinance_

Evidence

• report De.Fi REKT database listing (proof links: Token Sniffer post, 404, and the blog above) twitter.com
• report Sourcify repository copy of the same source repo.sourcify.dev
• address BscScan verified source, STEP 0x392acff173276da76b48b272119cad9f9f6286e2 bscscan.com
• analysis Scam Explained: BSC Stealthy LP Block cryptot3ddybear.gitlab.io