Falcon 9 SpaceX Token Honeypot
What happened
Falcon 9 SpaceX Token (FALCON9$X) is an Ethereum token deployed on 4 May 2021 at 0x539ede26…fa1b7a. The first transferFrom call from a non-zero address stores its recipient in a hidden variable called newun, and from then on every transfer or transferFrom to that address reverts with "please wait". If that first call is the router moving tokens into the Uniswap pair when liquidity is added, the pair becomes newun: buys from the pair still work, but any sale into the pair fails.
The owner can change newun at any time with transfernewun, and can withdraw any ETH held by the contract with clearCNDAO. De.Fi's REKT database lists Falcon 9 SpaceX Token as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.
How it happened
- The constructor credits the whole supply of 100,000,000,000,000 FALCON9$X (8 decimals) to the deployer, who is also
owner. - In
transferFrom, iffromis not the zero address andnewunis still unset, the contract setsnewun = toinstead of running any check. Adding liquidity through the Uniswap router moves tokens withtransferFrom(owner, pair, amount), which would make the pairnewun. - Every later
transferFromand everytransferrequiresto != newun, so a router sale (transferFrom(holder, pair, amount)) or a direct transfer to the pair reverts with "please wait". - A buy is the pair calling
transferto the buyer, whose address is notnewun, so purchases keep going through. - Only the owner can call
transfernewunto pointnewunsomewhere else and let sales through.Ownedhas norenounceOwnership, only a two-steptransferOwnership/acceptOwnership, and an eth_call on 2026-09-30 still returned the deployer asowner.
Protocol details
Evidence
- report De.Fi REKT database listing for FALCON9$X (proof links: Token Sniffer tweet and S4) twitter.com
- transaction Falcon 9 SpaceX Token contract creation transaction etherscan.io
- address Falcon 9 SpaceX Token verified contract code on Etherscan etherscan.io
- analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x539ede26b812e40aebadab83b8615343bcfa1b7a on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.