Digital Reserve Currency Honeypot

What happened

Digital Reserve Currency (DRG) is an Ethereum token whose transfer functions refuse any transfer to one stored address, newun. The first transferFrom call made while newun is empty stores its recipient in newun, and from then on every transfer or transferFrom to that address reverts with "please wait". The owner can also overwrite newun at any time with transfernewun.

A token sale through a DEX is a transfer to the pair contract, so if the stored address is the pair, holders cannot sell. De.Fi's REKT database lists DRG as an Exit Scam/Honeypot in which the owner could restrict users from selling.

How it happened

1. The constructor mints the whole supply (_totalSupply = 1000000000000000000000000000000 with 18 decimals) to the deployer, who becomes owner.
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call that reaches this line while newun is empty stores the recipient of that call in newun and is allowed through. The crypto security write-up of this pattern describes that first call as the one that adds liquidity, so newun becomes the liquidity pool address.
3. From then on, transferFrom reverts for any recipient equal to newun, and transfer starts with require(to != newun, "please wait");. A swap that sends tokens from a holder to the pool therefore reverts.
4. transfernewun(address _newun) public onlyOwner lets the owner replace newun. Pointing it at an unused address lifts the block; setting it to the zero address makes the next transferFrom capture a new recipient.
5. Buying is not affected by this check: tokens leaving the pool go to a holder, who is not newun.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract DRG

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing for DRG (as supplied in meta.json) twitter.com
• address Etherscan verified source: Digital Reserve Currency (DRG) etherscan.io
• analysis Sourcify repository copy of the same contract repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io