TESLAFARM.FINANCE Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists TESLAFARM.FINANCE (TSFARM), a BNB Smart Chain token at 0x9c0c6157…a4a2c4, as an Exit Scam/Honeypot dated 2021-04-21 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows a single destination address, newun, that transfer and transferFrom refuse to send tokens to, with the revert message please wait (please wait! in transferFrom). The first transferFrom call made while newun is empty sets newun to its recipient, and the owner can change it with transfernewun.

A sale that sends tokens to the address held in newun therefore reverts, and the holder's balance is not debited. The source alone does not show which address newun holds on-chain or what any holder lost, and De.Fi gives no loss figure.

How it happened

  1. The owner address receives the whole supply of 320000000000000000000000 raw units in the constructor, and the contract defines address public newun; with no initial value.
  2. transfer begins with require(to != newun, "please wait");, so no holder can send tokens to the address stored in newun.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait!");. While newun is the zero address, the first transferFrom call is allowed and stores its recipient as newun, with no other check on who made the call. Every later transferFrom to that recipient reverts. The cryptot3ddybear article on this pattern describes that first call as the liquidity add, which stores the pool address; the article does not cover TESLAFARM and this record does not show what newun holds on-chain.
  4. If newun is the pool, a sell moves tokens to it and the call reverts, and because the revert undoes the balance change the holder keeps their tokens. Transfers between ordinary wallets still pass.
  5. The owner can call transfernewun(address _newun) (onlyOwner). Setting it back to the zero address lets the next transferFrom capture a new recipient, and pointing it at an address that is never used lifts the block. The code allows this; the source alone does not show that either call was made.
  6. The contract also carries other owner tools (multisendErcTESLA, startSaleTESLA, startAirdropTESLA, and clearDOG(), which sends the contract's BNB balance to the owner). multisendErcTESLA does change balances: it moves 0.1 token (10^17 raw units) from the contract's own balance to each of up to 200 recipients. None of these tools sets newun or alters the transfer/transferFrom checks.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TSFARM

Evidence

Same attack technique

Browse all hacks →
BNB Chain Event Horizon Loss not disclosed Ethereum Rocket Inu Loss not disclosed BNB Chain MarsStop Loss not disclosed BNB Chain Ursa Major Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes