Wazir Farm Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Wazir Farm (WZR) is an Ethereum token whose transferFrom gates every transfer through an ensure check. The check passes only when the sender is the owner, the recipient is the owner, the sender equals tradeAddress, or the sender is flagged in canSale. Everyone else must satisfy condition, which returns false while the private variables _saleNum, _minSale and _maxSale are all 0, and nothing in the contract ever assigns them.

An ordinary holder therefore cannot send tokens to anyone but the owner. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-09 and describes it as an owner-controlled transfer restriction that stopped users from selling.

How it happened

  1. The constructor sets owner = msg.sender and gives the whole supply to the deployer. The contract has no function that changes owner.
  2. transfer calls transferFrom(msg.sender, _to, _value), and transferFrom requires ensure(_from, _to, _value) before moving any balance.
  3. ensure returns early only for exempt parties: if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Any other transfer falls through to require(condition(_from, _value));.
  4. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. _saleNum, _minSale and _maxSale are declared private and are never written anywhere in the contract, so they stay 0 and condition always returns false. Every transfer from a non-exempt holder to anyone other than the owner reverts, including a sale into a DEX pool or through a router.
  5. Only the owner can add exemptions, through functions whose names suggest something else: transferownership(address addr) sets tradeAddress = addr, and approveAndCall(address spender, uint256 addedValue) sets canSale[spender]=true and, when addedValue > 0, overwrites balanceOf[spender] = addedValue*(10**uint256(decimals)) without changing totalSupply.
  6. Because the pool address is itself a _from on buys, the code only lets a buyer receive tokens if the owner has exempted the pool; the code alone does not show whether or when that happened.

The sources opened here do not include a transaction showing the owner selling or draining liquidity.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WZR

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.