What happened
ChickenCoin was a BNB Chain token deployed on 2021-05-08 that De.Fi's REKT database lists as an exit scam/honeypot. Its verified code uses a known PancakeSwap sell-block pattern: a public address variable, newun, is set automatically to the recipient of the token's first transferFrom, which at launch is normally the liquidity pair, and every later transfer to that address reverts with "please wait". Holders can buy, because the pair sends tokens out with transfer, but cannot sell, because a sale must move tokens into the pair.
The owner can reassign newun at any time with transfernewun(), and the contract has no function to renounce ownership.
How it happened
TokenBEP20declaresaddress public newun;, which starts as the zero address.- The first call to
transferFromwith a non-zerofromrunsif(from != address(0) && newun == address(0)) newun = to;. When liquidity is added on PancakeSwap, the router pulls tokens from the adder into the new pair withtransferFrom, sonewunbecomes the pair address. - Every later
transferFromrunselse require(to != newun, "please wait");, andtransferstarts withrequire(to != newun, "please wait");. Any transfer into the pair, which is what a sell is, reverts. - Buys still succeed, because the pair pays out with
transfer(buyer, ...), whose recipient is notnewun. Buyers can enter but not exit. - The owner can change the blocked address with
function transfernewun(address _newun) public onlyOwner, so it can open the pair to itself and close it again.Ownedhas onlytransferOwnershipandacceptOwnership, with no renounce function. Whoever holds the pair's liquidity tokens can still remove liquidity, because the pair pays the tokens out withtransfer, which the check does not block.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
