CleanEnergyToken Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

CleanEnergyToken (CLEANENERGY, BNB Chain, contract 0xdee150ab…662241) keeps one address in a variable called newun and reverts every transfer whose recipient is that address. The first transferFrom made while newun is empty stores that call's recipient, so if it is the call that adds liquidity, the trading pair becomes the blocked address: selling through the pair reverts with "please wait" while buying from the pair still works. The owner can overwrite newun at any time with transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-06-17 and says the owner could disable the transfer function, which restricted users in selling their tokens; the listing gives no loss amount.

How it happened

  1. The constructor mints the whole supply to the deployer, who is owner: _totalSupply = 1000000000000000 ; with decimals = 0.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. While newun is zero, the first transferFrom is exempt from any check and its recipient is stored in newun. If that call is the router pulling the owner's tokens into the new pair during the liquidity add, the pair becomes newun.
  3. From then on transfer has require(to != newun, "please wait"); and transferFrom has else require(to != newun, "please wait");. A sale through the router is a transferFrom from the holder to the pair, so it reverts. A buy is a transfer from the pair to the buyer, whose address is not newun, so it succeeds. Neither check exempts the owner.
  4. transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Pointing it at an address nobody uses lifts the block; setting it to the zero address lets the next transferFrom store a new recipient. Owned offers transferOwnership and acceptOwnership but no renounce function.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract CLEANENERGY

Evidence

Same attack technique

Browse all hacks →
Ethereum HEXICO Loss not disclosed BNB Chain LOVELY SHIBA Loss not disclosed BNB Chain CosmoKitty Loss not disclosed Ethereum BitDao $686K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes