KodaRobotDog Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

KodaRobotDog Token (KodaRobotDog, 9 decimals) on BNB Chain gates transfers on a single address variable, newun. transfer and transferFrom revert with "please wait" when the recipient equals newun, so any sell that delivers tokens to that address fails while the sender's balance stays untouched. The first transferFrom made while newun is still the zero address stores its recipient as newun and goes through, and the owner can overwrite newun at any time with transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-18 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The code does not show which address ended up in newun, and no loss amount or liquidity-removal transaction was verified.

How it happened

  1. The constructor mints the full supply to the deployer: _totalSupply = 1000000000000000000; with balances[owner] = _totalSupply;. newun starts as the zero address.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. The first call made while newun is unset therefore records that call's recipient in newun and is not blocked. A third-party write-up of this code pattern says the initial DEX liquidity add is the call that captures the pair address; the contract itself does not say which address is stored.
  3. From then on, transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. Both checks sit before the balances updates, so a blocked transfer reverts and nothing is debited. If newun holds the liquidity pair, every sell that sends tokens into the pair reverts, while buys, which arrive through transfer out of the pair, are not affected.
  4. The owner can call transfernewun(address _newun), which is onlyOwner. Setting newun to the zero address re-arms the capture on the next transferFrom; pointing it at an address that is not used by the pair lifts the block for the pair. The contract has transferOwnership and acceptOwnership but no function that renounces ownership.
  5. What happened is limited to what De.Fi's REKT database lists: an Exit Scam/Honeypot on 2021-05-18. No transaction showing the block in effect or any liquidity withdrawal was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract KodaRobotDog

Evidence

Same attack technique

Browse all hacks →
BNB Chain PirateElon Loss not disclosed BNB Chain PANKY TOKEN Loss not disclosed BNB Chain YieldShiba.com Loss not disclosed BNB Chain MoonAkita Inu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes