TheAPIS Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

TheAPIS (APIS) is a BNB Smart Chain token whose transfer and transferFrom revert with "please wait" for any transfer to a single stored address, newun. That address is set automatically by the first transferFrom after deployment (whatever its recipient) and can be reset at any time by the owner with transfernewun, so a liquidity pair that ends up stored as newun can receive no tokens from holders. De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-04-26 and says the contract owner could disable the transfer function, which restricted users in selling their tokens.

The code does not show which address became newun on this token.

How it happened

  1. The constructor assigns the whole supply to the deployer (balances[owner] = _totalSupply;, _totalSupply = 1000000000000000000 with 8 decimals, 10 billion tokens) and leaves address public newun; unset (zero).
  2. transfer rejects any recipient equal to newun: require(to != newun, "please wait");. This applies to every caller, the owner included.
  3. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero from therefore stores its recipient in newun without any check; every later transferFrom to that address reverts. A DEX router moving tokens into a pair is a transferFrom, so if the pair is that first recipient, sells to it fail with "please wait". The code alone does not show which address was first.
  4. The owner can change the stored address at any time: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to an address that is never used lifts the block. Setting it back to the zero address re-arms capture, because the next transferFrom with a non-zero from stores its recipient again.
  5. Ownership can be handed over through transferOwnership and acceptOwnership; the contract has no renounce function. The on-chain owner read on 2026-09-30 is the deployer address 0xe1ec11ec…6f8751.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract APIS

Evidence

Same attack technique

Browse all hacks →
BNB Chain HoneyMoon Loss not disclosed Ethereum Monkey Token Loss not disclosed BNB Chain Flare Loss not disclosed BNB Chain LunarLaunchProject Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes