DOGE ROCKET Honeypot

What happened

DOGE ROCKET (DROCKET) is a BNB Chain token whose transfer and transferFrom functions refuse any transfer to a stored address called newun, reverting with the message "please wait". The first transferFrom call, while newun is unset, stores its recipient as newun, so a liquidity-adding call that sends tokens to the pair would register that pair as the blocked address and make later sales into it revert. The owner can also change newun with transfernewun.

De.Fi's REKT database lists the token as an exit scam/honeypot, saying the contract owner could restrict users from selling.

How it happened

1. The constructor hard-codes the owner (owner = 0x60cC6c1404a0fbA9B8E5fB910421c947bC0fEFB4;) and gives that owner the whole supply: balances[owner] = _totalSupply; (10,000,000,000 DROCKET at 18 decimals). The onlyOwner function transfernewun(address _newun) sets newun.
2. In transferFrom, the first call made while newun is empty sets it to the recipient: if(from != address(0) && newun == address(0)) newun = to;. Nothing in the code checks that this recipient is a trusted address.
3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer always runs require(to != newun, "please wait");. Any transfer into the stored address reverts, and no balance is debited because the revert undoes it.
4. If the stored address is the trading pair (the code alone does not show this; the linked write-up describes it for similar tokens), buys still work because tokens leave the pair, but a holder's sale sends tokens to the pair and reverts with "please wait".
5. The block can be lifted or re-armed only by the owner: pointing newun at an unused address lets transfers into the pair succeed, while setting it to address(0) lets the next transferFrom capture a new recipient. The owner also has clearCNDAO, which sends the contract's own native-currency balance to the owner.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract DROCKET

Evidence

• report @Token_Sniffer incident report twitter.com
• report DOGE ROCKET contract source (Sourcify match) repo.sourcify.dev
• report De.Fi REKT database listing for DROCKET (proof link Token Sniffer post, not retrievable) twitter.com
• address DOGE ROCKET contract source (BscScan code tab) bscscan.com
• analysis Scam explained: stealthy LP block (newun) cryptot3ddybear.gitlab.io