Gecko Token Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Gecko Token (GECKO) is an Ethereum token deployed on 22 April 2021 at 0xffea0019…abf543 by 0x1e410954…5d6DAD; Etherscan labels the contract Fake_Phishing220946. Its transferFrom saves the recipient of the first transferFrom call as newun; when liquidity is added through a router, that recipient is the pool. After that, every transfer or transferFrom into newun reverts with "please wait", so buys out of the pool work but no holder can sell into it.

Only the owner can change newun, through transfernewun, and removing liquidity sends tokens out of the pool, not into it, so it stays open. The contract has no renounceOwnership. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor mints the whole supply, 1,000,000,000,000 GECKO at 18 decimals, to the owner.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. When a router's add-liquidity call moves the owner's tokens into the pool with transferFrom, the pool becomes newun.
  3. From then on transferFrom runs require(to != newun, "please wait"), and transfer runs the same check. A router sale sends the seller's tokens into the pool, so it reverts; buys send tokens out of the pool and pass.
  4. transfernewun(address _newun) is onlyOwner, so only the owner can point newun elsewhere and reopen sales.
  5. Whoever holds the pool's LP tokens can remove liquidity at any time, because the pool paying out tokens is a transfer from newun, not to it. The blog post De.Fi cites describes this template's exit as pulling liquidity after one-way buying.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract GECKO

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonWhale Loss not disclosed Ethereum Fish Tank Loss not disclosed Ethereum Gorillaz Sunshine Loss not disclosed BNB Chain Ergosphere Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes