What happened
Koinu (koinuinu.finance) was an Ethereum token whose transferFrom function records the first recipient it ever sees in a variable called newun, then rejects every later transfer to that address with the error "please wait". Because the first transferFrom is normally the router pulling tokens into the Uniswap pool when liquidity is added, the pool itself becomes the blocked address: tokens can flow out of the pool to buyers, but no holder can send tokens back into it to sell. The owner can also repoint newun to any address at any time through transfernewun.
The source comment advertises 3% redistribution and 3% auto-liquidity fees, but that fee code is commented out and never runs. De.Fi's REKT database lists Koinu as an exit scam / honeypot dated 2021-06-07.
How it happened
- The owner receives the whole supply at deployment (
balances[owner] = _totalSupply;), andnewunstarts empty. - The first call to
transferFromfindsnewun == address(0)and stores the recipient:if(from != address(0) && newun == address(0)) newun = to;. When liquidity is added through a router, that recipient is the Uniswap pair. - From then on, both
transferandtransferFromrunrequire(to != newun, "please wait");, so any swap that moves Koinu into the pair reverts. Buying still works because the pair sends tokens out to the buyer, not to itself. - The owner can change the blocked address at any time with
transfernewun(address _newun) public onlyOwner, so the block can be lifted or moved at the owner's discretion; there is no renounce function, only a two-steptransferOwnership/acceptOwnership. - The code places no restriction on tokens leaving the pair, so whoever holds the pool's LP tokens can remove liquidity while holders cannot sell. Whether that happened for Koinu is not established by the sources reviewed.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address KoinuInu (koinuinu.finance, Koinu) verified source code etherscan.io
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x7984b2bff45bae100306cb9134962e8d4df3877a on Ethereum repo.sourcify.dev
- analysis koinuinu.finance (Koinu) token page on Etherscan etherscan.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
