DogeMissile Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DogeMissile (DogeMissile) is a BNB Chain token at 0x0cc6d4ee…869c7b, deployed on 2021-05-14. Both transfer and transferFrom revert with "please wait" when the recipient equals a stored address called newun, and the first transferFrom call stores its own recipient in newun. A holder who tries to send tokens to that address, which is what a sell into a liquidity pool does, is rejected, and the owner can change newun at any time with transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-14 and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor sets the name and symbol to DogeMissile, mints a supply of 1000000000000000000000000000000000 raw units (10^15 tokens at 18 decimals) to the deployer and makes it owner.
  2. The first transferFrom call with a non-zero from runs if(from != address(0) && newun == address(0)) newun = to;, so whichever address receives that first transferred amount is stored as newun. The code does not say which address that is; the technique write-up the listing links to describes this pattern capturing the liquidity pool address in other tokens.
  3. Every later transferFrom takes the else require(to != newun, "please wait"); branch, and transfer runs require(to != newun, "please wait");. Any transfer whose recipient is newun reverts, and the holder's balance is not debited because balances[from] = balances[from].sub(tokens); runs after the check.
  4. The owner can call transfernewun(address _newun), which is onlyOwner and has no cap or delay in the code. Setting newun to address(0) lets the next transferFrom capture a new recipient, and pointing it at an unused address lifts the block.
  5. What happened: De.Fi's REKT database lists DogeMissile as an Exit Scam/Honeypot. No opened transaction or source in this review shows the owner calling transfernewun or removing liquidity.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DogeMissile

Evidence

Same attack technique

Browse all hacks →
BNB Chain SHINKY Loss not disclosed BNB Chain SAD CAT Loss not disclosed BNB Chain DogelonMars Loss not disclosed Ethereum Cheetah Coin Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes