ElonDash Honeypot

What happened

The ElonDash (EDASH) token on Ethereum, contract 0x8f3aee35…6b744d, stores one hidden address, newun, and refuses every transfer whose recipient is that address. newun is filled automatically by the first transferFrom call, which is the call a router makes when liquidity is added, so the liquidity pair can end up as the blocked recipient and selling into it reverts with "please wait". Only the owner can reassign newun.

De.Fi's REKT database lists this token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The token is deployed with the whole supply credited to the deployer, who is also owner: balances[owner] = _totalSupply;.
2. The first transferFrom call while newun is unset records its recipient: if(from != address(0) && newun == address(0)) newun = to;. When a liquidity add goes through a router, that recipient is the pair. An analysis of this contract family describes exactly this capture; whether it happened for this token's pair was not checked in a transaction.
3. From then on every later transferFrom runs the else branch, else require(to != newun, "please wait");, and transfer carries the same check, require(to != newun, "please wait");. A holder selling through a router calls transferFrom(holder, pair, amount), so to == newun and the call reverts.
4. Buying is not blocked by this check: the pair sends tokens out with to set to the buyer, which differs from newun, so holders can receive tokens but cannot sell them back to the pair.
5. The owner keeps control of the block through function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address re-arms the capture for the next transferFrom. The code has no renounce function, only transferOwnership/acceptOwnership.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract EDASH

Evidence

• report @Token_Sniffer incident report twitter.com
• address ElonDash (EDASH) verified source on Etherscan etherscan.io
• analysis Sourcify copy of ElonDash.sol repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io