What happened
KOALA (symbol Koala Forest) is an Ethereum token deployed on 10 April 2021 at 0x8037fb7a…552a68 by 0xeD25E9Ce…a21126, which received the whole 1,000,000,000,000-token supply and is still the owner. The code comments advertise Safemoon-style fees, a 50% burn and locked liquidity, but the contract implements none of them; instead, the first transferFrom ever made, normally the router adding liquidity, silently stores its destination (the pair) in a variable named newun. After that, every transfer to that address reverts with "please wait", so holders can buy from the pool but cannot sell back into it, and only the owner can repoint newun with transfernewun.
De.Fi's REKT database lists KOALA as a honeypot.
How it happened
- The constructor gives the whole supply to the deployer:
_totalSupply = 100000000000000000000; balances[owner] = _totalSupply;(1,000,000,000,000 tokens at 8 decimals). - The first
transferFromcall stores its destination:if(from != address(0) && newun == address(0)) newun = to;. When liquidity is added through a router, that destination is the pair. - Buys work, because the pair pays buyers through
transfer, which only rejects transfers whose destination isnewun. - A sale sends tokens to the pair, and both paths check the destination:
transferhasrequire(to != newun, "please wait");andtransferFromrunselse require(to != newun, "please wait");, so every sell reverts. - The owner can change the blocked address at any time with
function transfernewun(address _newun) public onlyOwner, which can reopen the pair for chosen moments or block another address.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- transaction KOALA contract creation transaction etherscan.io
- address KOALA verified source code etherscan.io
- analysis Sourcify match for 0x8037fb7ade8d4bfb106083289a57657b26552a68 on Ethereum repo.sourcify.dev
- analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
