BongWeedCoin Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists BongWeedCoin ($BWC) as an exit scam/honeypot on BSC, noting that the owner could stop holders from selling. In the verified source the control is a stored address, newun: after it is set, any transfer or transferFrom whose recipient is that address reverts with "please wait". newun is filled automatically by the first transferFrom and can also be set by the owner with transfernewun.

If it points at the trading pool, buys still work but sells into the pool revert.

How it happened

  1. The constructor sets the deployer as owner and gives it the whole supply: balances[owner] = _totalSupply;.
  2. newun starts as the zero address. The owner can change it at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }.
  3. The first transferFrom from a non-zero sender while newun is unset stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. That transfer succeeds. A liquidity add through a router is a transferFrom into the pool, so the pool address is a natural value for newun; the code does not name it, and the linked write-up describes this capture.
  4. Every later call is checked against it. transfer has require(to != newun, "please wait"); and transferFrom has else require(to != newun, "please wait");. The balance subtraction comes after the check, so a blocked call reverts and nothing is debited.
  5. If newun is the pool, a sell, which a router executes as transferFrom(seller, pool, amount), always reverts. A buy moves tokens out of the pool with transfer(buyer, amount), whose recipient is not newun, so it passes.
  6. The owner keeps control of the block: setting newun back to the zero address re-arms capture on the next transferFrom, while pointing it at an address nothing uses lifts the restriction.
  7. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot. No transaction showing the owner calling transfernewun or a failed sell was opened for this record.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract $BWC

Evidence

Same attack technique

Browse all hacks →
Ethereum dmoon.finance Loss not disclosed BNB Chain NeuroChain Loss not disclosed BNB Chain 1000xCoin Loss not disclosed BNB Chain Centrifuge Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes