What happened
HORNY (listed as Horny Farm) was an ERC-20 token on Ethereum (0x865ba66e…4e67ec) that blocked every sale into its Uniswap pool. The token stores one blocked address, newun. The first transferFrom call sets newun to that call's recipient, and from then on any transfer or transferFrom to newun reverts with "please wait".
The contract's first transferFrom was the Uniswap router moving the deployer's tokens into the new pool, so the pool itself became the blocked address. Buys, which send tokens out of the pool, kept working, but every sell reverted. On 9 April 2021 at 23:50:32 UTC the deployer, 0x2C5BA746…574D7d, added the entire 6,900,000 HORNY supply and 9 ETH to Uniswap V2.
At 00:13:06 UTC on 10 April it removed all of its LP tokens, receiving 10.65 ETH and 5,833,893 HORNY. The extra ETH came from buyers who could not sell. Its source comment advertises a 6.9% burn tax, but the code charges none.
Etherscan flags the contract as phishing, and De.Fi's REKT database lists it as a honeypot.
How it happened
- The constructor credits the full supply to the owner:
_totalSupply = 690000000000000;with 8 decimals (6,900,000 HORNY),balances[owner] = _totalSupply;. transferFromsets the blocked address on its first use:if(from != address(0) && newun == address(0)) newun = to;. Every later call runselse require(to != newun, "please wait");, andtransferalways runsrequire(to != newun, "please wait");.- At 23:50:32 UTC on 9 April 2021 the deployer called
addLiquidityETHwith 6,900,000 HORNY and 9 ETH (transaction 0x938f52d2…b35cd4). The router'stransferFromfrom the deployer to the new pair 0x59ba94e8…1B9bf0 was the contract's firsttransferFrom, sonewunbecame the pair. - From then on, buys worked because tokens moved out of the pair to buyers. A sell has to move tokens to the pair, so it reverted with "please wait". Seven other addresses approved the token between 23:50 and 23:59 UTC.
- The owner can move the block with
transfernewun(address)and can withdraw any ETH held by the token withclearCNDAO. - At 00:13:06 UTC on 10 April 2021, about 23 minutes after adding liquidity, the deployer burned all 0.0788 LP tokens with
removeLiquidityETHWithPermit. It received 10.65 ETH and 5,833,893 HORNY (transaction 0xafebccfb…13c7af). This payout is not blocked because the tokens leave the pair rather than go to it. The deployer then sent 11 ETH onward (transaction 0x9a500c90…2496b2).
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report Token Sniffer post cited by De.Fi as proof twitter.com
- transaction Etherscan transaction list for 0x865ba66ec2fc688c481135faaf787f9c9a4e67ec etherscan.io
- transaction Etherscan transaction 0x938f52d2...5cd4 (liquidity add) etherscan.io
- transaction Etherscan transaction 0xafebccfb...c7af (liquidity removal) etherscan.io
- address HORNY (Horny Farm) verified source code on Etherscan etherscan.io
- address Etherscan address 0x2C5BA746dceD06aA9Dcff448b691B55BC8574D7d (HORNY deployer) etherscan.io
- analysis Sourcify match for 0x865ba66ec2fc688c481135faaf787f9c9a4e67ec on Ethereum repo.sourcify.dev
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
