WhereLambo Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

WhereLambo (WAMBO) is a BNB Smart Chain token that permanently refuses transfers to one address. The first transfer or transferFrom that moves tokens stores its recipient in _xowner, and from then on every transfer to that address reverts with "Recipient not found." Nothing in the contract changes _xowner afterwards, including the owner. If the first recipient was a liquidity pair, every sell into that pair fails.

De.Fi's REKT database lists the token as an exit scam/honeypot and says the owner could disable the transfer function; the code has no such switch.

How it happened

  1. The constructor mints 250,000,000 tokens with 9 decimals (_tokenSupply = 250000000 * 10**9) to the deployer, who becomes owner(). It credits the balance with the two-argument setWallets, which never touches _xowner.
  2. Every _transfer calls the three-argument setWallets(sender, recipient, ...), which contains if(sender != address(0) &&_xowner == address(0)){ _xowner = recipient; }else{ require(recipient != _xowner, "Recipient not found."); }. The first transfer by any non-zero sender passes and stores its recipient in _xowner.
  3. After that, every transfer whose recipient is _xowner reverts, whoever the sender is. A sell through a router moves the holder's tokens to the pair, so if the pair is _xowner the sell reverts. The revert comes before the sender's balance is written, so the holder keeps the tokens. The code does not name the pair, so which address was captured is not established here.
  4. Transfers out of _xowner are not blocked, because only the recipient is checked. A pair paying a buyer is therefore not affected.
  5. The only code that reads _xowner is getBurnAddress() (owner-only, view) and setWallets; there is no setter. renounceOwnership and transferOwnership exist but control nothing about the block. A read of owner() on 2026-09-30 returned the deployer address 0x7b476bb3…30bc27. No opened transaction shows which address _xowner holds or that sells failed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WAMBO

Evidence

Same attack technique

Browse all hacks →
BNB Chain MaxGoatToken Loss not disclosed BNB Chain LuckyDoge Loss not disclosed BNB Chain NEPTUNE Token Loss not disclosed BNB Chain WOODEN Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes