India Pale Ale Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

India Pale Ale (IPA) is a BEP-20 token on BNB Chain whose transfer and transferFrom both revert with "please wait" for any transfer to an address stored in the newun variable. The first transferFrom call while newun is empty stores its recipient in newun, so whichever address first receives tokens through transferFrom (typically how a router moves tokens into a liquidity pair) becomes a destination nobody can send tokens to. The contract owner can also overwrite newun with transfernewun.

De.Fi's REKT database lists the token as an exit scam/honeypot on 2021-05-03 and describes the owner as able to disable the transfer function so users could not sell; no loss amount is listed.

How it happened

  1. The owner deploys TokenBEP20 with the name India Pale Ale, symbol IPA, 9 decimals and a supply of 100000000000000000 base units, all credited to the owner. newun starts as the zero address.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first transferFrom as newun. Nothing is checked on that first call, so it goes through.
  3. From then on, every transferFrom takes the else require(to != newun, "please wait"); branch, and transfer runs require(to != newun, "please wait");. Any transfer whose recipient is newun reverts, and neither check has an exception for the owner or any other address.
  4. A holder can still receive tokens from newun and move them elsewhere, but cannot send tokens to it. If newun is the liquidity pair, that blocks selling into the pool while buying continues to work. The source does not say which address newun holds; that depends on who made the first transferFrom call, which would need a transaction to confirm.
  5. The owner controls the block through function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block. Setting it to the zero address instead re-arms capture, because the next transferFrom would overwrite it again. The source has no function that renounces ownership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract IPA

Evidence

Same attack technique

Browse all hacks →
Ethereum PIethori Loss not disclosed Ethereum Dfyn.Network Loss not disclosed BNB Chain Rocket Man Loss not disclosed BNB Chain PHOENIXTOKEN Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes