Beagle Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Beagle is a BEP-20 token on BNB Chain at 0xca141dae…b1d509, deployed on 20 March 2021 at 08:49 UTC. De.Fi's REKT database lists it as an exit scam/honeypot. The verified source hides a sell block in a variable named newun: the first transferFrom call records its recipient as newun, and from then on every transfer or transferFrom sending tokens to that address reverts with "please wait".

When the deployer adds PancakeSwap liquidity, that first recipient is the trading pair, so holders can buy but cannot sell back into the pool. The owner can also repoint newun at any address with transfernewun.

How it happened

  1. The owner receives the full 10 billion token supply in the constructor (balances[owner] = _totalSupply).
  2. Adding liquidity makes the router call transferFrom(owner, pair, amount). Because newun is still address(0), the line if(from != address(0) && newun == address(0)) newun = to; stores the pair address in newun without reverting.
  3. Buyers purchase Beagle from the pair. The pair pays out with transfer to the buyer, and the check require(to != newun, "please wait") only blocks transfers whose recipient is newun, so buys succeed.
  4. A sale sends tokens to the pair, either through the router's transferFrom or a direct transfer. Both functions now hit require(to != newun, "please wait") and revert, so holders cannot swap back to BNB.
  5. The owner keeps the ability to change the blocked address with transfernewun(address) (onlyOwner), which could lift the block for a moment, and removing liquidity is unaffected because tokens leaving the pair are sent to a recipient other than newun.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Beagle

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.