JizzUs Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

JizzUs (JIZUS) is a 3-decimal BEP20 token on BNB Smart Chain whose transfer and transferFrom functions refuse any move whose recipient equals a stored address called newun. The contract fills newun itself from the recipient of the first transferFrom call, and the owner can overwrite it at any time with transfernewun. If newun ends up holding the liquidity pair, a holder's sell into the pair reverts with "please wait", while transfers out of the pair are not touched by this check.

De.Fi's REKT database lists JIZUS as an Exit Scam/Honeypot dated 2021-05-13 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The contract was deployed on 2021-05-11 at 23:29:10 UTC by 0x6B01D20a…07AB2e in transaction 0x0150c5dd…95a076.

How it happened

  1. The constructor gives the whole supply to the deployer: owner = msg.sender and balances[owner] = _totalSupply; with _totalSupply = 10000 * 10**6 * 10**8, which is 10^18 raw units, or 10^15 tokens at 3 decimals.
  2. The first transferFrom call sets the blocked address without any check: if(from != address(0) && newun == address(0)) newun = to;. A router liquidity deposit pulls tokens with transferFrom, so in that flow the pair would become newun; a write-up of this code pattern describes the pair being captured this way. The contract itself never names the pair.
  3. Once newun is set, every later transferFrom runs else require(to != newun, "please wait"); and every transfer runs require(to != newun, "please wait");. A router sell calls transferFrom(holder, pair, amount), so if newun is the pair the call reverts before balances[from] is debited. The owner is not exempt from the check.
  4. The owner controls the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block for the pair; setting it to the zero address re-arms the capture in step 2 for the next transferFrom recipient. The contract has no timelock of its own and no cap on how often this can be called.
  5. JizzUs also defines clearCNDAO(), which sends the contract's whole BNB balance to the owner, and a payable fallback function() external payable {} that lets the contract receive BNB.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract JIZUS

Evidence

Same attack technique

Browse all hacks →
BNB Chain Patrigio Loss not disclosed BNB Chain ShinyDoge Loss not disclosed BNB Chain Mia Khalifa Loss not disclosed BNB Chain SHIBAMOON Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes