Jade Currency Honeypot

What happened

Jade Currency ($Jade) is a BEP20 token with a hidden sell block in transferFrom. A variable newun starts at zero; the first transferFrom call stores its recipient in newun, and afterwards every transfer or transferFrom sent to that address reverts with "please wait". A security write-up on this pattern says newun captures the liquidity pool address when the owner adds liquidity, so buys work but sells back to the pool fail.

De.Fi's REKT database lists $Jade as an Exit Scam/Honeypot dated 2021-05-25; no loss figure is given.

How it happened

1. The constructor sets decimals = 9; and _totalSupply = 1000000000000000000; (1 billion tokens at 9 decimals) and gives all of it to the deployer: balances[owner] = _totalSupply;. newun stays at the zero address.
2. In transferFrom, the first call with a non-zero from runs if(from != address(0) && newun == address(0)) newun = to;, recording the recipient without any check. The code does not name the pool; the write-up cited below describes the owner's initial liquidity add as the call that sets it, and no transaction was opened here.
3. Once newun is set, transferFrom takes else require(to != newun, "please wait");, and transfer has require(to != newun, "please wait");.
4. A router-based sale calls transferFrom(holder, pool, amount). If the pool is the stored newun, the call reverts and the holder's balance is not debited, so the sale fails. Buys send tokens from the pool to the buyer, whose address is not newun, so this check does not block them.
5. The owner can change the block with transfernewun(address _newun) (onlyOwner). Setting it to zero re-arms capture on the next transferFrom; pointing it at an unused address lifts the block.
6. What the code allows is the block above. What happened is only that De.Fi's REKT database lists $Jade as a honeypot; no sale attempt, owner call to transfernewun or loss was verified.

Protocol details

Classification Token

Protocol Type Farm

Affected asset / contract $Jade

Protocol links Website @jadecurrency1

Evidence

• report De.Fi REKT database listing (proof links: Token Sniffer post, 404, and the blog above) twitter.com
• report Sourcify repository copy of the same source repo.sourcify.dev
• address BscScan verified source, Jadecurrency 0xb890a97fcd3ddca7a7fd66337ca851f57dc38558 bscscan.com
• analysis Scam Explained: BSC Stealthy LP Block cryptot3ddybear.gitlab.io