CURLYPUFF Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

CURLYPUFF is a BNB Chain token deployed on 21 March 2021 at 0x470c4af2…2daf0a. Its contract keeps a hidden target address, newun: the first transferFrom made while newun is empty stores that call's recipient, and from then on every transfer or transferFrom to newun reverts with "please wait". When the first transferFrom is the router moving the owner's tokens into a new PancakeSwap pair, the pair becomes newun, so every sale into the pool fails while purchases paid out of the pool still work.

Only the owner can point newun somewhere else, through transfernewun. De.Fi's REKT database lists CURLYPUFF as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling their tokens.

How it happened

  1. The constructor mints the full 10,000,000,000 CURLYPUFF supply to the deployer, who becomes owner, and leaves newun as the zero address.
  2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to;, so the recipient of the first transferFrom becomes newun. When the owner adds liquidity through the PancakeSwap router, the router's transferFrom into the pair is that first call.
  3. Every later transferFrom runs require(to != newun, "please wait"), and transfer runs the same check. A router sale moves the holder's tokens to the pair, so it reverts.
  4. Purchases move tokens from the pair to the buyer, whose address is not newun, so buying keeps working.
  5. The owner-only transfernewun(address) can reset newun to any address, which is the only way to reopen sales. The owner-only clearCNDAO() sends any BNB held by the token contract to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract CURLYPUFF

Evidence

Same attack technique

Browse all hacks →
BNB Chain Hoe Coin BSC Loss not disclosed BNB Chain LamboPUMP Loss not disclosed BNB Chain SonicSwap Loss not disclosed BNB Chain NFT Farm Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes