X1000 ONLY Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists X1000 ONLY on BNB Smart Chain as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function and so restrict users from selling. The verified source shows a variant of a known pattern: transferFrom stores the recipient of the first call in a variable called newun, and from then on both transfer and transferFrom revert with "please wait" for any transfer to that address. If that first recipient is the liquidity pool, buyers can still receive tokens from the pool but cannot send them back to it.

The contract was deployed on 2021-05-16 at 23:25 UTC in transaction 0x8c0dc497…fe376d. No loss figure is listed.

How it happened

  1. newun starts as the zero address. The owner can set it to any address with transfernewun(address _newun) public onlyOwner.
  2. In transferFrom, the first call made while newun is zero stores the recipient: if(from != address(0) && newun == address(0)) newun = to;. The call is not restricted to the owner, and the tokens move normally.
  3. If that first transferFrom is the one that moves tokens into a liquidity pool (the pattern the opened gitlab article describes for similar tokens), newun becomes the pool address. The code does not show which address newun holds; that needs an on-chain read.
  4. From then on, every later transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. A holder who sells through a router has the router call transferFrom(holder, pool, amount), so the transfer to newun reverts and the holder's balance is not changed.
  5. Transfers from the pool to a buyer are not blocked, because the check only looks at the recipient. Buying works while selling to the same address fails.
  6. The owner can lift the block by pointing newun at an address that is never used as a recipient. Setting it back to the zero address does not lift it: the next transferFrom stores its recipient again. The source has no renounceOwnership, and transferOwnership only starts a two-step handover to a new owner.
  7. clearCNDAO() lets the owner send the contract's own BNB balance to the owner, which is separate from the token-selling restriction.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract X1000

Evidence

Same attack technique

Browse all hacks →
BNB Chain T-Rex Loss not disclosed BNB Chain AERION Loss not disclosed BNB Chain GDRAGON Loss not disclosed BNB Chain KumaInu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes