Chicken Soup Protocol Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

De.Fi's REKT database lists Chicken Soup Protocol (SOUP) as an Exit Scam/Honeypot on Ethereum and says the owner could disable the transfer function, restricting users from selling. The verified code does not have a global transfer switch. Instead it stores one address in a variable called newun and reverts every transfer whose recipient equals it with the message "please wait".

newun is filled automatically by the first successful transferFrom and can be reassigned by the owner at any time, so a sell into a trading pool can be blocked while buys still work.

How it happened

  1. The constructor mints the full supply to the deployer, who is also the owner: balances[owner] = _totalSupply;.
  2. transfer rejects any transfer to the stored address: require(to != newun, "please wait");.
  3. transferFrom has a self-arming branch: if(from != address(0) && newun == address(0)) newun = to;. The first transferFrom that completes while newun is empty stores its recipient, and that call is not checked. Every later call runs else require(to != newun, "please wait");. Liquidity added through a router uses transferFrom, so the recipient stored there is whichever address receives that first transfer. The code does not show which address newun holds on chain.
  4. Once newun is the address that holders must send tokens to when selling, a sell reverts with "please wait". Only the recipient is checked, so transfers out of newun, such as a buyer receiving tokens, are not blocked.
  5. The owner can change the block at will with transfernewun(address _newun), which is onlyOwner. Setting it to the zero address re-arms the capture in step 3 on the next transferFrom; pointing it at an unused address lifts the block.
  6. clearCNDAO() is also onlyOwner and sends any ETH balance held by the token contract to the caller.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract SOUP

Evidence

Same attack technique

Browse all hacks →
BNB Chain Ergosphere Loss not disclosed Ethereum JiX Swap Loss not disclosed BNB Chain WARONRUGS Loss not disclosed BNB Chain ROCKETMARS Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes