TRUMP 2024 Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

TRUMP 2024 (TRUMP2024) is a BEP-20 token on BNB Smart Chain, deployed from 0xcCf00dD3…Ce81bA at contract address 0x5dd104f6…af3f60. All 10 billion tokens are minted to a hard-coded owner address, 0x0D71a922…1E20fD, in the constructor. The token's transfer and transferFrom functions contain a variable, newun, that records the first address to receive tokens through transferFrom and then rejects every later transfer to that address with the message "please wait".

A trading pool receives tokens whenever someone sells, so once the pool address is captured, selling reverts while buying (tokens leaving the pool) is not checked. De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the contract owner could disable the transfer function, restricting users from selling; it gives no loss figure and no transaction hashes.

How it happened

  1. The constructor sets symbol = "TRUMP2024", name = "TRUMP 2024" and _totalSupply = 10000000000e18, and assigns the whole supply to balances[owner]; the owner address is hard-coded as owner = 0x0D71a922E4523A1A1b4BbF6ab40F5Fb0241E20fD.
  2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero sender therefore stores its recipient in newun without any check. A router-based liquidity add moves the owner's tokens to the pool with transferFrom, so the pool can become newun this way (the code allows this; the on-chain newun value was not read).
  3. From then on every transferFrom whose recipient equals newun reverts, because the else branch requires to != newun. A sell through a router calls transferFrom(seller, pool, amount), so it fails for every holder. transfer has the same guard: require(to != newun, "please wait");.
  4. Buys are not affected by this check: the pool pays buyers with transfer(buyer, amount), and the guard only tests the recipient against newun. Holders can therefore acquire tokens that they cannot sell back through the pool.
  5. The owner can call transfernewun(address _newun) (onlyOwner) to overwrite newun. Setting it to address(0) makes the next transferFrom recipient be captured again, so the block re-arms; only pointing it at an address that is not the pool lifts it. The only ownership functions are transferOwnership and acceptOwnership; there is no renounceOwnership.
  6. clearCNDAO() (onlyOwner) sends the contract's own BNB balance to the owner, and the contract has a payable fallback. This does not touch holders' tokens or the pool.
  7. What happened on chain is not established here: no sell transactions, liquidity removal or owner calls were opened. Only De.Fi's REKT database listing states that selling was restricted.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TRUMP2024

Evidence

Same attack technique

Browse all hacks →
BNB Chain Pera Finance Loss not disclosed BNB Chain Free Britney Loss not disclosed BNB Chain MoonPilot Loss not disclosed BNB Chain BabyElonDoo Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes