ZUMBA MARS Honeypot

What happened

ZUMBA MARS (ZUMBAMARS) is a BNB Chain token deployed on 18 June 2021 at 0xaacb1b20…ca95c0 by 0x18d86B84…068d7e. Its balance-update helper records the recipient of the very first transfer in a hidden variable, _xowner, and from then on rejects every transfer to that address. When the first transfer is the deposit of tokens into the PancakeSwap pair, the pair becomes _xowner, so buys still work but no holder can sell back into the pool.

The block needs no owner action, so renouncing ownership does not remove it. De.Fi's REKT database lists ZUMBA MARS as a honeypot; no loss figure is recorded.

How it happened

1. The constructor credits the deployer with 100 trillion ZUMBAMARS (9 decimals) and makes the deployer owner.
2. Every transfer and transferFrom calls _transfer, which updates the sender's balance through setWallets(sender, recipient, amount).
3. On the first transfer _xowner is still empty, so the helper stores that transfer's recipient: _xowner = recipient;.
4. On every later transfer the helper runs require(recipient != _xowner, "Recipient not found."), so any transfer to the stored address reverts.
5. If the first transfer is the liquidity deposit, the stored address is the pair. Buys (pair to buyer) pass, but sales (holder to pair) revert with an error message that hides the reason.
6. The stored address can be read only through the owner-only getBurnAddress, a name that suggests a burn wallet rather than the blocked pair.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ZUMBAMARS

Evidence

• report Report tokensniffer.com
• transaction ZUMBA MARS contract creation transaction bscscan.com
• address ZUMBA MARS (ZUMBAMARS) verified contract code on BscScan bscscan.com
• analysis Sourcify match for 0xaacb1b205345a7b99228dfdc3a7d321b51ca95c0 on BNB Chain repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear blog, April 2021) cryptot3ddybear.gitlab.io