ElonGate Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

This ElonGate (ELONGATE) token is a BNB Chain contract deployed on 10 May 2021 at 0x82f79bc7…38ea2d by 0xf9B0603d…6fdCD7, which still owns it. Its comments copy marketing text from the ElonGate charity project (400K holders, a 1 quadrillion fixed supply), but the constructor mints 100,000,000 tokens to the deployer. The first transferFrom the contract ever processes stores its destination in newun, and every later transfer to that address reverts with "please wait".

When the first transferFrom is PancakeSwap's liquidity deposit, newun is the pair: buys still work because the pair sends tokens out with transfer, but every sale, which sends tokens into the pair, fails. The owner can also point newun at any address with transfernewun. This is the same pattern cryptot3ddybear described in April 2021 for SafeBinance and SafeRocket, and De.Fi's REKT database lists this ElonGate token as an exit scam/honeypot.

How it happened

  1. The constructor sets owner = msg.sender (0xf9B0603d…6fdCD7) and credits it the full _totalSupply of 100000000000000000 raw units (100,000,000 ELONGATE at 9 decimals).
  2. newun starts as the zero address. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first transferFrom as newun. Adding liquidity through the PancakeSwap router is a transferFrom from the deployer to the pair, so the pair is recorded if that is the first one.
  3. From then on, both transfer and transferFrom run require(to != newun, "please wait"). The check is on the recipient, so any transfer into the pair reverts, which is every sale; buys, where the pair pays out with transfer to the buyer, still go through.
  4. transfernewun(address _newun) is onlyOwner and can set newun to any address at any time, including the zero address, so the owner controls whether and where the block applies.
  5. Liquidity withdrawal is not blocked: removing liquidity makes the pair send tokens out, not in. clearCNDAO() also lets the owner withdraw any BNB the contract holds. The two-step transferOwnership/acceptOwnership exists, but owner read on-chain is still the deployer.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ELONGATE

Evidence

Same attack technique

Browse all hacks →
BNB Chain NoCapCoin Loss not disclosed BNB Chain DoubtFire Loss not disclosed BNB Chain PIDGEY Loss not disclosed Ethereum French Shiba Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes