Symbol Honeypot

What happened

Symbol (XYM) is a BNB Smart Chain token whose transfer and transferFrom revert with "please wait" for any transfer sent to the address stored in newun. transferFrom stores the recipient of the first call it sees in newun, and the owner can later change it with transfernewun. If newun is the liquidity pool, ordinary holders can receive tokens from it but cannot send tokens into it, so swaps that sell the token fail.

De.Fi's REKT database lists the token as an exit scam/honeypot, stating that the contract owner could disable the transfer function and restricted holders from selling.

How it happened

1. The contract stores one address in address public newun;, empty until set.
2. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait"); means the recipient of the first transferFrom with a non-zero from becomes newun, and that call goes through. Every later transferFrom to that address reverts.
3. In transfer, require(to != newun, "please wait"); blocks the same address for direct transfers. The check is on the recipient, so any holder sending to newun is blocked.
4. A DEX router sells a token by calling transferFrom(holder, pair, amount). If the first transferFrom was the liquidity add, the pair is the stored address, and every sell then reverts with "please wait". Transfers out of the pair to buyers are not blocked by this code. The code alone does not show which address newun holds; that depends on the first transferFrom call, which no opened transaction shows.
5. transfernewun(address _newun) public onlyOwner lets the owner reassign newun at any time. Setting it to address(0) re-arms the capture on the next transferFrom; pointing it at an unused address lifts the block.
6. The write-up by cryptot3ddybear (S3) describes this same newun line in other tokens as capturing the pool address on the first liquidity add and says buyers can buy but not sell; it does not mention Symbol itself.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract XYM

Evidence

• report @Token_Sniffer incident report twitter.com
• report Token Sniffer tweet (De.Fi proof link) twitter.com
• address BscScan verified source, Symbol bscscan.com
• analysis Sourcify repository match for Symbol repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io