TESLA Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

TESLA (TESLA) is a 9-decimal BEP20 token on BNB Smart Chain whose transfer and transferFrom functions refuse any move whose recipient equals a stored address called newun. The contract fills newun itself from the recipient of the first transferFrom call, and the owner can overwrite it at any time with transfernewun. If newun ends up holding the liquidity pair, a holder's sell into the pair reverts with "please wait", while transfers out of the pair are not touched by this check.

De.Fi's REKT database lists TESLA as an Exit Scam/Honeypot dated 2021-05-13 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The contract was deployed on 2021-05-13 at 04:52:42 UTC by 0x9dF83049…713f14 in transaction 0x5de10134…7e55d5.

How it happened

  1. The constructor gives the whole supply to the deployer: owner = msg.sender and balances[owner] = _totalSupply; with _totalSupply = 100000000000000000 raw units, which is 100,000,000 tokens at 9 decimals. The source header also says Sales automatically activated after first 100 holders!, but the code contains no holder counter or activation switch.
  2. The first transferFrom call sets the blocked address without any check: if(from != address(0) && newun == address(0)) newun = to;. A router liquidity deposit pulls tokens with transferFrom, so in that flow the pair would become newun; a write-up of this code pattern describes the pair being captured this way. The contract itself never names the pair.
  3. Once newun is set, every later transferFrom runs else require(to != newun, "please wait"); and every transfer runs require(to != newun, "please wait");. A router sell calls transferFrom(holder, pair, amount), so if newun is the pair the call reverts before balances[from] is debited. The owner is not exempt from the check.
  4. The owner controls the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block for the pair; setting it to the zero address re-arms the capture in step 2 for the next transferFrom recipient. The contract has no timelock of its own and no cap on how often this can be called.
  5. TESLA also defines clearCNDAO(), which sends the contract's whole BNB balance to the owner, and a payable fallback function() external payable {} that lets the contract receive BNB.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TESLA

Evidence

Same attack technique

Browse all hacks →
BNB Chain Mia Khalifa Loss not disclosed BNB Chain SHIBAMOON Loss not disclosed BNB Chain THANKS ELON Loss not disclosed BNB Chain DoucheCoin Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes