Elon SpaceEX Honeypot

What happened

De.Fi's REKT database lists Elon SpaceEX (ELONEX) as an exit scam/honeypot on Ethereum, saying the owner could disable transfers so holders could not sell. The verified source implements this with a hidden address variable, newun: the first transferFrom call records its recipient in newun, and from then on every transfer or transferFrom to that address reverts with "please wait". If the recorded address is a liquidity pool, selling into the pool is blocked while buying from it is not.

The owner can also overwrite newun through transfernewun.

How it happened

1. The constructor mints the whole supply to the deployer: balances[owner] = _totalSupply; with _totalSupply = 10000000000000000000; at 8 decimals, which is 100,000,000,000 tokens. There is no mint function afterwards.
2. A public variable newun starts as the zero address. transfer rejects any recipient equal to it: require(to != newun, "please wait");.
3. transferFrom contains the capture step: if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero from therefore succeeds and stores its to in newun; the caller does not need to be the owner. A DEX router adding liquidity moves tokens with transferFrom, so when that is the first such call, the pool address is the one stored (the code alone does not show which call came first on-chain).
4. After that, any transfer or transferFrom whose recipient is the stored address reverts. Selling through a pool means sending tokens to the pool, so a stored pool address blocks sells. Transfers out of the pool to buyers do not hit the check.
5. The owner can edit the stored address at any time: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address re-arms the capture on the next transferFrom; setting it to an unused address lifts the block.
6. The owner can also withdraw any ETH held by the token contract with clearCNDAO().
7. A write-up of this code pattern on BSC tokens describes the same sequence (initial liquidity add sets the hidden variable to the pool address, later transfers to it are stopped, and liquidity is withdrawn at the inflated price). That page names other tokens, not this one.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract ELONEX

Evidence

• report @Token_Sniffer incident report twitter.com
• address Etherscan verified source, Elon SpaceEX 0xa489ef785e94e4fb437bddfabdeaf3c9545f9aa9 etherscan.io
• analysis Sourcify repository copy of ELONEX.sol repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io