Inu Doge Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Inu Doge (INUDOGE) is an Ethereum token deployed on 12 May 2021 at 0xd42961b8…c5d6c7 by 0x32C1130C…E3790B, which the constructor also sets as the fixed _owner. Every transfer and transferFrom runs the burnTokenCheck modifier, which lets the owner, a special _safeOwner address and whitelisted wallets move tokens but makes every other holder's transfer revert unless it is sent to the Uniswap router address. A Uniswap sale moves tokens into the pair, not the router, so ordinary holders can buy but not sell, and the revert shows the misleading message "ERC20: transfer amount exceeds balance".

The whitelist and blacklist setters hide behind ERC-20 names (increaseAllowance, addApprove, decreaseAllowance), there is no function to change or renounce the owner, and the "liquidity locked for 6 months" constants are never used. Etherscan shows a GoPlusSecurity phishing warning and labels the deployer Fake_Phishing195331, and De.Fi's REKT database lists Inu Doge as an exit scam/honeypot.

How it happened

  1. The constructor mints 1,000,000,000,000,000 INUDOGE to the owner argument (0x32C1130C…E3790B) and sets both _owner and _safeOwner to it. No other code writes _owner.
  2. In burnTokenCheck, while _owner == _safeOwner, the owner's first outgoing transfer runs _safeOwner = recipient. If that first transfer is the liquidity deposit into the Uniswap pair, the pair becomes _safeOwner; the owner can also set it directly with decreaseAllowance(address safeOwner).
  3. Transfers where the sender is _owner or _safeOwner, or the recipient is _owner, always pass, so buys out of a pair set as _safeOwner go through. Senders marked by increaseAllowance(address[]) (the whitelist) also pass.
  4. Every other sender hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). _unirouter is the Uniswap V2 router, but a sale transfers the holder's tokens to the pair, so it reverts. Senders marked by addApprove(address[]) (the blacklist) are always held to this check.
  5. An unlisted sender passes only if amount < _sellAmount. _sellAmount starts at 0, and the owner can raise it by transferring tokens to itself; a transfer under the limit into _safeOwner then puts the seller on the blacklist, so at most one small sale works.
  6. _mint(address,uint256) is public and owner-only and credits _balances[_owner] with any amount. The total supply read on 2026-09-30 equals the constructor mint, so the code allows extra minting but the current supply shows none.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract INUDOGE

Evidence

Same attack technique

Browse all hacks →
BNB Chain PIDGEY Loss not disclosed Ethereum French Shiba Loss not disclosed BNB Chain HONEYROCKET Loss not disclosed BNB Chain SpaceXDoge1 Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes