What happened
Stratos (STT) is a BEP20 token on BNB Smart Chain, with a header comment describing the Stratos decentralized data mesh, whose transferFrom and transfer functions refuse any transfer to an address stored in a variable named newun. The first transferFrom call made while newun is empty stores that call's recipient in it, and from then on every transfer to that address reverts with "please wait". In the pattern described in a public write-up of this code family, that stored address is the liquidity pool, so buyers can receive tokens but a swap back to BNB fails.
The owner can also reassign newun with transfernewun. De.Fi's REKT database lists this token as an exit scam/honeypot dated 2021-05-26 and says the owner could disable the transfer function, which restricted users in selling their tokens; no loss figure is given.
How it happened
- The constructor sets the owner to the deployer,
owner = msg.sender;(deployer 0xB1b8237a…5C54E5 per the deploy transaction), and mints the whole supply to it:balances[owner] = _totalSupply;. transferFromcontains a capture rule:if(from != address(0) && newun == address(0)) newun = to;. The firsttransferFrommade whilenewunis empty stores its recipient innewunand is not otherwise checked. A public analysis of this pattern says this happens when liquidity is added, sonewunbecomes the PancakeSwap pool address (the code itself does not show which address is stored here).- Once
newunis set, theelsebranch runs on every latertransferFrom:else require(to != newun, "please wait");.transfercarries the same check:require(to != newun, "please wait");. A sell is atransferFromfrom the seller to the pool, so it reverts. Moving tokens out of the pool to a buyer does not hit this check. - The owner controls the lock:
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. The owner can pointnewunat an unused address to lift the block, or set it to the zero address so the nexttransferFromcaptures a new recipient. - The owner can also pull any BNB held by the token contract:
_owner.transfer(address(this).balance);inclearCNDAO. Nothing in the code shows whether any BNB was sent to it.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
