Cresco Honeypot

What happened

Cresco's transferFrom stores the recipient of the first call it sees in a public variable named newun, and from then on every transfer or transferFrom whose recipient equals newun reverts with the message "please wait". When that first call is a router moving the owner's tokens into a liquidity pool, newun becomes the pool address, so holders' sells into the pool revert while the pool paying tokens out to buyers is not blocked. The owner can repoint newun at any time with transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot with no loss figure.

How it happened

1. The constructor sets _totalSupply = 1 * 10**7 * 10**3 (decimals 3, so 10,000,000 tokens) and credits it to owner, the deployer 0xe995dBD0…210B2D.
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; followed by else require(to != newun, "please wait");. The first transferFrom while newun is the zero address therefore succeeds and records its recipient as newun; in the usual liquidity-add flow that recipient is the pool.
3. transfer starts with require(to != newun, "please wait");, and every later transferFrom takes the else branch with the same check. A holder's sell, in which a router calls transferFrom(holder, pool, amount), has to == newun and reverts. Tokens leaving the pool to a buyer have a different recipient and are not blocked by this check.
4. No address is exempt from the check, including the owner. The owner-only transfernewun(address _newun) overwrites newun: pointing it at an unused address lifts the block, setting it to the zero address re-arms the capture so the next transferFrom overwrites it with its own recipient, and pointing it at a holder's address blocks transfers to that holder. There is no renounceOwnership; owner() read as the deployer address on 2026-09-30.
5. The linked blog post documents this same newun pattern in other tokens, where it calls the check a stealthy block on the liquidity pool.
6. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-07-02. No transaction showing a reverted sell or any transfernewun call was opened, and the source does not show who held the liquidity tokens, so the code shows what the owner can do, not what was done.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract Cresco

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source for Cresco 0x106a579c85cca81363ad72466d689c863ebf8bcc bscscan.com
• analysis BSC-SCAM: Stealthy LP Block cryptot3ddybear.gitlab.io
• analysis Sourcify match for 0x106a579c85cca81363ad72466d689c863ebf8bcc (chain 56) repo.sourcify.dev
• analysis De.Fi REKT database listing for Cresco (Exit Scam/Honeypot, 2021-07-02) de.fi