SupHerbs Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

SupHerbs (SUPHERBS) is a BEP-20 token on BNB Smart Chain, deployed from 0x256Dd162…AD37cF in transaction 0xc06b752c…262c09 on 2021-05-20. De.Fi's REKT database lists it as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function and so restrict users from selling. The verified source contains a transfer block built on a variable named newun: the first transferFrom records its recipient in newun, after which any transfer or transferFrom to that address reverts with "please wait".

The source file's header comment advertises fees, a locked liquidity fee and a burn, but the code contains no fee or burn logic. The source alone does not show which address ended up in newun or whether any sale actually failed.

How it happened

  1. The constructor mints the whole supply to the deployer, who becomes owner: balances[owner] = _totalSupply;.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. While newun is still the zero address, the first transferFrom therefore stores its recipient in newun. Liquidity added through a router is a transferFrom into the pair, so on a typical pool setup that recipient would be the pair; the code itself does not name the pair.
  3. After that, every later transferFrom whose recipient equals newun fails the else require(to != newun, "please wait") check. transfer has the same guard: require(to != newun, "please wait");.
  4. A holder's sale through a router pulls tokens into the pair with transferFrom. If newun holds the pair address, that call reverts before balances[from] is reduced, so the holder keeps the tokens but cannot swap them back.
  5. The owner controls the block: transfernewun(address _newun) public onlyOwner sets newun to any address. Pointing it at an unused address lifts the block; setting it back to the zero address re-arms capture by the next transferFrom. Nothing in the source shows which address newun holds or that the owner called this function.
  6. clearCNDAO() is onlyOwner and sends the contract's own BNB balance to the owner, and the SUPHERBS contract accepts BNB through function() external payable.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SUPHERBS

Evidence

Same attack technique

Browse all hacks →
BNB Chain LETHE Token Loss not disclosed BNB Chain TeslaModelS Plaid Loss not disclosed Ethereum Smells Like Updoge Loss not disclosed BNB Chain SafeMEME Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes