What happened
De.Fi's REKT database lists Gorillaz Sunshine (GRSUN) as an Exit Scam/Honeypot on Ethereum and says the owner could disable the transfer function, restricting users from selling. The verified code has no global transfer switch. It keeps one address in a variable called newun and reverts every transfer whose recipient equals it with the message "please wait".
newun is filled by the first successful transferFrom and can be reassigned by the owner at any time, so sells into a trading pool can be blocked while buys still work.
How it happened
- The constructor mints the full supply to the deployer, who is also the owner:
balances[owner] = _totalSupply;. transferrejects any transfer to the stored address:require(to != newun, "please wait");.transferFromhas a self-arming branch:if(from != address(0) && newun == address(0)) newun = to;. The firsttransferFromthat completes whilenewunis empty stores its recipient, and that call is not checked. Every later call runselse require(to != newun, "please wait");. Liquidity added through a router usestransferFrom, so the stored recipient is whichever address receives that first transfer. The code does not show which addressnewunholds on chain.- Once
newunis the address holders must send tokens to when selling, a sell reverts with "please wait". Only the recipient is checked, so transfers out ofnewun, such as a buyer receiving tokens, are not blocked. - The owner can change the block at will with
transfernewun(address _newun), which isonlyOwner. Setting it to the zero address re-arms the capture in step 3 on the nexttransferFrom; pointing it at an unused address lifts the block. clearCNDAO()is alsoonlyOwnerand sends any ETH balance held by the token contract to the caller.
Protocol details
Classification
Token
Protocol Type
Exit Scam/Honeypot
Affected asset / contract
GRSUN
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
