DogeTeen Honeypot
What happened
DogeTeen (DogeTeen) is a BEP20 token on BNB Smart Chain, deployed 2021-06-28 at 0x3070c539…d05435. Its transfer functions store an address in a variable called newun and revert any transfer whose recipient is that address with the message "please wait". The first transferFrom call stores its recipient in newun, which on a DEX is normally the liquidity pair, so a sell that routes tokens to the pair reverts while buys, which move tokens out of the pair, still work.
The owner can also overwrite newun through transfernewun. De.Fi's REKT database lists DogeTeen as an Exit Scam/Honeypot without a loss figure and describes it as an owner-controlled block on selling.
How it happened
What the code allows:
- The owner (the deployer, 0x8FFd97F3…617d45) receives the whole supply in the constructor:
balances[owner] = _totalSupply;. transferFromrunsif(from != address(0) && newun == address(0)) newun = to;so the firsttransferFromwith a non-zero sender stores its recipient innewun. A liquidity add through a router callstransferFrom(owner, pair, amount), so the pair would be stored. That transfer itself succeeds.- After that, every call to
transferFromtakes theelse require(to != newun, "please wait");branch, and every call totransferrunsrequire(to != newun, "please wait");. Any transfer whose recipient is the stored address reverts. - A holder's sell sends tokens to the pair (a router calls
transferFrom(holder, pair, amount)), so it reverts. A buy moves tokens out of the pair withtransfer(buyer, amount); the recipient is the buyer, notnewun, so it passes. The same rule also blocks the owner from sending tokens to the pair again. transfernewun(address _newun) public onlyOwnerlets the owner overwritenewunat any time. Setting it toaddress(0)re-arms capture on the nexttransferFrom; pointing it at an unused address lifts the block for the pair.OwnedhastransferOwnershipandacceptOwnershipbut no renounce function.clearCNDAO()isonlyOwnerand sends the contract's own BNB balance to the caller. It does not touch token balances.
De.Fi's REKT database lists DogeTeen as an Exit Scam/Honeypot with no stated loss. The transaction that stored newun and any call to transfernewun were not examined here, so whether the block was triggered or lifted on-chain is not established.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.