Hoge Finance v2 Honeypot

What happened

Hoge Finance v2 (HOGE) is a BEP-20 token on BNB Smart Chain at 0x416b661f…98c887, deployed in transaction 0x326c5485…e505aa. De.Fi's REKT database lists it as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling. In the verified source the restriction is a single stored address, newun: both transfer and transferFrom revert when the recipient equals it, and the first transferFrom made while it is unset writes that call's recipient into it.

The owner can repoint it with transfernewun. The sources opened do not include a transaction showing holders being blocked.

How it happened

1. The constructor mints the whole supply (_totalSupply = 10000000000000000000000000000, 10 billion tokens at 18 decimals) to the deployer, who becomes owner, and leaves newun as the zero address.
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from while newun is unset does not revert and stores its own recipient in newun. Liquidity added through a router pulls tokens with transferFrom, so the recipient of that first call would be whatever address receives the tokens; the source does not say which address that was for this token.
3. From then on transfer runs require(to != newun, "please wait"); and transferFrom runs the same check, so any movement of tokens to the stored address reverts for every sender, including holders. Balances are only debited after these checks, so a blocked transfer leaves the holder's balance in place.
4. A swap that sells the token into a pool sends the holder's tokens to the pool through transferFrom. If the pool is the stored newun, that sale reverts with "please wait". Buying is a transfer out of the pool, which the check does not touch.
5. The owner can call transfernewun(address _newun) at any time. Pointing it at an unused address lifts the block; setting it to the zero address lets the next transferFrom with a non-zero from capture a new recipient. The contract has transferOwnership/acceptOwnership but no renounce function.
6. Separately, clearCNDAO() lets the owner send the token contract's own BNB balance to themselves. That is the contract's balance, not a liquidity pool's.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract HOGE

Evidence

• report De.Fi REKT database listing for HOGE twitter.com
• address BscScan verified source for Hoge Finance v2 (HOGE) bscscan.com
• analysis Sourcify match for 0x416b661f2baa6b98042eb351b0345543c898c887 on chain 56 repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io