Douyea Honeypot

Reported loss $6K
Ethereum
Honeypot

What happened

Douyea (YEA) is an ERC-20 with a hidden transfer gate: the deployer can call ints to set a second privileged address, and from then on every transfer that does not involve the deployer reverts unless its sender is that address, the Uniswap router or a wallet the deployer whitelisted. A holder selling through the router is the sender of the internal transfer, so the sale reverts, while the deployer's own transfers are never checked. The deployer added 20,800 YEA and 100 ETH of liquidity at 13:16:26 UTC on 2020-12-10 (tx 0x2150c732…316019) and removed liquidity at 05:30:44 UTC on 2020-12-13, receiving 19,648.64 YEA and 105.74 ETH (tx 0x90126a3f…0cb8b9).

De.Fi's REKT database lists the token as an exit scam / honeypot with $6,426 lost and states that the contract owner could disable the transfer function, restricting users from selling.

How it happened

  1. What the code allows: the constructor sets _address0 = owner; and _address1 = owner; and mints the supply to _address0. While the two are equal, the _ints check never fires, so trading works normally.
  2. The owner can arm the gate at any time: function ints(address addressn) public { require(msg.sender == _address0, "!_address0");_address1 = addressn; }. Once _address1 differs from _address0, the condition _address0!=_address1 in _ints is true.
  3. _transfer calls _ints(sender, recipient, amount) before moving balances, and _ints reverts unless the sender is approved: if(recipient != _address0 && sender != _address0 && _address0!=_address1 && amount > _zero){require(sender == _address1 ||sender==_router || _Addressint[sender], "ERC20: transfer from the zero address");}. A router sale executes transferFrom(holder, pair, amount), so sender is the holder and the call reverts, as does a plain transfer between holders. Transfers from or to _address0 skip the check. Whether purchases still work depends on the address given to ints: a buy has the pair as sender, so it passes only if _address1 is the pair.
  4. The owner can exempt chosen wallets: multiaddress(uint8 AllowN, address[] receivers, uint256[] amounts) sends tokens from the owner and, for the first AllowN receivers, sets _Addressint[receivers[i]] = true; and _approve(receivers[i], _router, _valuehash); (the maximum uint256 allowance), so those wallets can sell while others cannot. The contract has no ownership transfer or renounce function; ints(_address0) is the only way the owner could re-open trading.
  5. What happened, per Etherscan: the deployer added 20,800 YEA and 100 ETH to Uniswap V2 at 13:16:26 UTC on 2020-12-10 and, at 05:30:44 UTC on 2020-12-13, removed liquidity with 1,441.2205 of the 1,442.2205 LP tokens minted, receiving 19,648.64 YEA and 105.74 ETH. De.Fi's REKT database lists the token as a honeypot. No opened transaction shows whether ints was called or any holder's sale reverted.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract YEA
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum Stable Yield Credit $494K lost Ethereum Harvester Network $6K lost Ethereum AutoTrade Finance $32K lost Ethereum Yearn Hold Finance $17K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes