E-Coin Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

E-Coin (E-Coin) is a BEP-20 token on BNB Smart Chain whose transferFrom records the first recipient it sees in a variable called newun and from then on rejects every transfer to that address. When liquidity is added through a router, that first recipient is the liquidity pair, so tokens can still leave the pair (buys) but cannot be sent back to it (sells). De.Fi's REKT database lists E-Coin as an exit scam / honeypot dated 2021-08-30, stating that the owner could disable the transfer function and so restrict users from selling their tokens.

The owner can also repoint the block with transfernewun. No transaction showing a failed sell or removed liquidity has been opened, and De.Fi gives no loss figure.

How it happened

What the code allows, not a record of what was done:

  1. The constructor mints the whole supply to the deployer: _totalSupply = 100000000000000000; and balances[owner] = _totalSupply;. With decimals = 8 this is 1,000,000,000 E-Coin.
  2. transferFrom captures an address on first use: if(from != address(0) && newun == address(0)) newun = to;. A router adding liquidity pulls the owner's tokens into the pair with transferFrom, so when that is the first transferFrom call after deployment, newun becomes the pair address and that transfer succeeds.
  3. From then on both transfer paths refuse that address: transfer has require(to != newun, "please wait"); and transferFrom has else require(to != newun, "please wait");.
  4. A buy leaves the pair through transfer with the buyer as to, which is not newun, so it passes. A sell goes through a router's transferFrom(seller, pair, amount) with to == newun, so it reverts with please wait. Holders can acquire tokens but cannot sell them into that pool. The same check blocks the owner's own sells into the pair while newun points at it.
  5. The owner controls the block through function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing newun at the pair blocks sells, pointing it at an unused address lifts the block, and setting it to address(0) re-arms capture so the recipient of the next transferFrom becomes the blocked address.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract E-Coin

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.