IPX Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists IPX (symbol Tachyon) on BNB Smart Chain as an Exit Scam/Honeypot and describes the contract owner as able to disable the transfer function, which restricted users from selling. The verified source for 0x2dbafe66…c1ae54 shows a variable called newun that is captured from the first transferFrom call. Once it is set, every transfer and transferFrom to that address reverts with "please wait", and only the owner's transfernewun can change it.

If the captured address is the trading pair, holders cannot sell back into it; the code does not show which address was captured on-chain.

How it happened

  1. The owner deploys the contract and receives the whole supply: balances[owner] = _totalSupply;. The newun variable starts as the zero address.
  2. The first transferFrom made while newun is unset runs if(from != address(0) && newun == address(0)) newun = to;. Whatever address receives that first transfer becomes newun. A first liquidity deposit made through a router uses transferFrom, so the pool would be captured this way, but the code alone does not show which address was captured.
  3. From then on transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. Neither has an exemption for the owner or any other address, so any transfer whose recipient is newun reverts. A holder selling into a captured pool sends tokens to that pool and is blocked.
  4. Transfers out of newun and between other addresses are not checked, so the pool can still pay tokens out, for example to buyers or to a liquidity provider withdrawing.
  5. The owner can call transfernewun(_newun) at any time. Setting it to the zero address lets the next transferFrom capture a new recipient, while pointing it at an unused address lifts the block. Nothing in the code shows whether the owner called it.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract Tachyon

Evidence

Same attack technique

Browse all hacks →
Ethereum Horse Protocol Loss not disclosed BNB Chain Librex Loss not disclosed Ethereum Diamond Hands Elon Loss not disclosed BNB Chain Pumpamental Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes