Kobe Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Kobe (KOBE) is a BEP-20 token on BNB Chain that blocks every sale into its liquidity pool. The first transferFrom the contract sees, normally the PancakeSwap router pulling the owner's tokens into the new pair when liquidity is added, stores that recipient in a variable named newun. After that, both transfer and transferFrom revert with please wait whenever the recipient is newun, so holders can buy from the pool but cannot sell back into it.

The owner can repoint newun at any time with transfernewun. The same newun trap was documented in April 2021 in BNB Chain tokens such as SafeRocket; De.Fi's REKT database lists Kobe as an exit scam/honeypot, with no loss figure.

How it happened

  1. The constructor credits the whole supply, 100000000000000000000 raw units (1,000,000,000,000 KOBE at 8 decimals), to the owner; newun starts as address(0).
  2. When liquidity is added through the PancakeSwap router, the router calls transferFrom(owner, pair, amount). Because newun == address(0), the line if(from != address(0) && newun == address(0)) newun = to; records the pair as newun and lets that first transfer through.
  3. Buys still work: the pair sends KOBE to the buyer with transfer, and the buyer is not newun.
  4. A sell sends KOBE to the pair, through the router's transferFrom or a direct transfer. Both check require(to != newun, "please wait"), so every sell reverts with a message that suggests a temporary delay.
  5. transfernewun(address _newun) is onlyOwner, so the owner can move the block to another address, which would reopen sells, or reset it to zero so the next transferFrom recipient is blocked instead.
  6. Removing liquidity sends KOBE out of the pair rather than into it, so the block does not stop whoever holds the LP tokens from withdrawing the pool's BNB.
  7. clearCNDAO() lets the owner withdraw any BNB held by the token contract itself. There is no renounceOwnership; ownership changes only when a new address calls acceptOwnership after transferOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract KOBE

Evidence

Same attack technique

Browse all hacks →
BNB Chain BraveHeart TOKEN Loss not disclosed Ethereum Kimchi Inu Loss not disclosed BNB Chain ORANGE TOKEN Loss not disclosed BNB Chain NFT ECO Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes