What happened
De.Fi's REKT database lists Trace Network (Trace) on BNB Chain as an exit scam/honeypot and describes the owner as able to disable the transfer function so that users could not sell. In the verified source the block is a stored address called newun. The first transferFrom call with a non-zero from writes its recipient into newun; after that, any transfer or transferFrom whose recipient equals newun reverts with "please wait".
If that first call was the movement of tokens into a trading pool during the initial liquidity add, newun holds the pool address, so holders cannot sell into it while transfers out of the pool and between wallets are not touched by this check. Only the owner can overwrite newun, through transfernewun. The sources opened do not include a transaction for this token, so who held the liquidity and whether it was withdrawn is not established here.
How it happened
- The constructor sets
owner = msg.senderand assigns the whole supply to it withbalances[owner] = _totalSupply;. newunstarts as the zero address. The owner can set it to any address withfunction transfernewun(address _newun) public onlyOwner { newun = _newun; }.- In
transferFrom, the lineif(from != address(0) && newun == address(0)) newun = to;runs the first time any spender moves tokens: it stores that call's recipient innewun. The rest of the function still debitsbalances[from]and the allowance, so this first call looks like an ordinary transfer. - From then on, the
elsebranchelse require(to != newun, "please wait");runs on everytransferFrom, andtransferhasrequire(to != newun, "please wait");. Any transfer intonewunreverts and the sender's balance is not debited. - When
newunis the liquidity pool, a holder's sale into the pool and any later liquidity add by a holder revert. Transfers whose recipient is notnewun(buys paid out of the pool, wallet-to-wallet moves) pass these checks. - The block applies to the owner as well while
newunpoints at the pool. Settingnewunto the zero address re-arms the capture on the nexttransferFrom; pointing it at an unused address lifts the block. The code shows the owner can do either; no transaction opened here shows it did.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
