E-Coin Honeypot
What happened
E-Coin (E-Coin) is a BEP-20 token on BNB Smart Chain whose transferFrom records the first recipient it sees in a variable called newun and from then on rejects every transfer to that address. When liquidity is added through a router, that first recipient is the liquidity pair, so tokens can still leave the pair (buys) but cannot be sent back to it (sells). De.Fi's REKT database lists E-Coin as an exit scam / honeypot dated 2021-08-30, stating that the owner could disable the transfer function and so restrict users from selling their tokens.
The owner can also repoint the block with transfernewun. No transaction showing a failed sell or removed liquidity has been opened, and De.Fi gives no loss figure.
How it happened
What the code allows, not a record of what was done:
- The constructor mints the whole supply to the deployer:
_totalSupply = 100000000000000000;andbalances[owner] = _totalSupply;. Withdecimals = 8this is 1,000,000,000 E-Coin. transferFromcaptures an address on first use:if(from != address(0) && newun == address(0)) newun = to;. A router adding liquidity pulls the owner's tokens into the pair withtransferFrom, so when that is the firsttransferFromcall after deployment,newunbecomes the pair address and that transfer succeeds.- From then on both transfer paths refuse that address:
transferhasrequire(to != newun, "please wait");andtransferFromhaselse require(to != newun, "please wait");. - A buy leaves the pair through
transferwith the buyer asto, which is notnewun, so it passes. A sell goes through a router'stransferFrom(seller, pair, amount)withto == newun, so it reverts withplease wait. Holders can acquire tokens but cannot sell them into that pool. The same check blocks the owner's own sells into the pair whilenewunpoints at it. - The owner controls the block through
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointingnewunat the pair blocks sells, pointing it at an unused address lifts the block, and setting it toaddress(0)re-arms capture so the recipient of the nexttransferFrombecomes the blocked address.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address Verified ECoinTOKEN source on BscScan (0xc8716697e93d4a44e62cacb5ea468ab277d3d54d) bscscan.com
- analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io
- analysis Sourcify match for the same contract repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.