Wazir Farm Honeypot
What happened
Wazir Farm (WZR) is an Ethereum token whose transferFrom gates every transfer through an ensure check. The check passes only when the sender is the owner, the recipient is the owner, the sender equals tradeAddress, or the sender is flagged in canSale. Everyone else must satisfy condition, which returns false while the private variables _saleNum, _minSale and _maxSale are all 0, and nothing in the contract ever assigns them.
An ordinary holder therefore cannot send tokens to anyone but the owner. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-09 and describes it as an owner-controlled transfer restriction that stopped users from selling.
How it happened
- The constructor sets
owner = msg.senderand gives the whole supply to the deployer. The contract has no function that changesowner. transfercallstransferFrom(msg.sender, _to, _value), andtransferFromrequiresensure(_from, _to, _value)before moving any balance.ensurereturns early only for exempt parties:if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Any other transfer falls through torequire(condition(_from, _value));.conditionstarts withif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;._saleNum,_minSaleand_maxSaleare declaredprivateand are never written anywhere in the contract, so they stay 0 andconditionalways returns false. Every transfer from a non-exempt holder to anyone other than the owner reverts, including a sale into a DEX pool or through a router.- Only the owner can add exemptions, through functions whose names suggest something else:
transferownership(address addr)setstradeAddress = addr, andapproveAndCall(address spender, uint256 addedValue)setscanSale[spender]=trueand, whenaddedValue > 0, overwritesbalanceOf[spender] = addedValue*(10**uint256(decimals))without changingtotalSupply. - Because the pool address is itself a
_fromon buys, the code only lets a buyer receive tokens if the owner has exempted the pool; the code alone does not show whether or when that happened.
The sources opened here do not include a transaction showing the owner selling or draining liquidity.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.