SUPERCYCLE Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SUPERCYCLE ($SUPER) is a BEP-20 token whose transfer and transferFrom both refuse any recipient equal to a variable called newun. The newun variable is filled either by the owner through transfernewun or automatically, with the recipient of the first transferFrom made while it is unset. Tokens can still leave the newun address but cannot be sent back to it.

De.Fi's REKT database lists the token as an exit scam/honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens. The code shows the block is possible; no opened source shows what newun was set to or what happened to holders.

How it happened

  1. The constructor sends the whole supply to the deployer: balances[owner] = _totalSupply;. The deployer is also owner and the only caller of the owner-only functions.
  2. transfernewun(address _newun) public onlyOwner sets newun, and transfer starts with require(to != newun, "please wait");, so no direct transfer can send tokens to that address.
  3. transferFrom begins if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero from while newun is unset succeeds and stores its recipient as newun. Every later transferFrom to that recipient reverts before balances[from] is reduced, so the sender keeps their tokens.
  4. Nothing checks from against newun, so transfers out of that address are not blocked by this code. Which address newun ends up as depends on the first transferFrom or on the owner; the code does not name it.
  5. The block can be lifted only by the owner pointing newun at an address nobody sends to. Setting it back to the zero address re-arms the automatic capture, because the next transferFrom writes a new recipient into it. Owned also allows transferOwnership/acceptOwnership, and nothing in the file renounces ownership.
  6. The opened write-up (dated 2021-04-11) describes this same code in other BNB Smart Chain tokens, where newun was the PancakeSwap pool set on the first add-liquidity call, so buys worked and sells back to the pool reverted. It does not cover SUPERCYCLE, and no transaction for this token was opened; the listing for this record comes from De.Fi's REKT database.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SUPER

Evidence

Same attack technique

Browse all hacks →
Ethereum London X Protocol Loss not disclosed Ethereum Oportunity Token Loss not disclosed Ethereum SolstarterToken Loss not disclosed BNB Chain DOGE ROCKET Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes