What happened
DRAGON INU (DRAGON INU, BNB Chain, contract 0x6b5d65dc…f47acb) combines a sell block with an owner pause switch. Once an owner-sent transferFrom has stored a recipient in newun, every transfer to that address from anyone but the owner reverts with "please wait"; if that recipient is the trading pair, holders cannot sell through it while buying still works. Separately, rewardbnb() sets a paused flag that makes _transfer revert unless the owner is the sender or recipient, and burn(address,uint256) is an owner-only function that raises the total supply with no cap.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-06-16 and says the owner could disable the transfer function, which restricted users in selling their tokens; the listing gives no loss amount.
How it happened
- The constructor gives the whole supply to the deployer, who becomes
owner():_balances[_msgSender()] = _totalSupply;with_totalSupply = 100000000 * 10**9. transferFromstarts withif(sender != address(0) && newun == address(0)) newun = recipient;, and_transferthen runsif(newun != address(0)) require(recipient != newun || sender == owner(), "please wait");. Because that second check runs afternewunis set, only a call whose sender isowner()survives; a non-owner's first call reverts and the assignment is rolled back. Sonewunis stored when the owner is the sender, for example if the router pulls the owner's tokens into a new pair during the liquidity add.- After that, any
transferortransferFromwhose recipient isnewunreverts unless the sender isowner(). A sale through the router is atransferFromfrom the holder to the pair, so it reverts. A buy sends tokens from the pair to the buyer, and ordinary wallet-to-wallet transfers pass, so buying works while selling does not. The owner is exempt and can still send tokens tonewun. transfernewun(address _newun) public onlyOwneroverwritesnewun. Pointing it at an unused address lifts the block; setting it to the zero address removes it until the nexttransferFromwithowner()as sender stores a recipient again.- A second switch:
rewardbnb() onlyOwner whenNotPausedsetspaused = true, and_transfercontainsrequire(!paused || sender == owner() || recipient == owner(), "paused");. While paused, every transfer that does not involve the owner reverts, buys as well as sells.bnbpool()clears the flag. burn(address _to, uint256 _amount) onlyOwnerruns_totalSupply = _totalSupply.add(_amount); _balances[_to] = _balances[_to].add(_amount);. Despite its name it mints without a cap, and because the owner is exempt from both thenewunandpausedchecks, the code lets minted tokens be sent to the pair.- These powers stay with the owner unless
renounceOwnership()is called. A current-stateowner()read on 2026-09-30 still returned the deployer address.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
