Kyushu Inu Honeypot
What happened
Kyushu Inu (KYNU) is an Ethereum token whose transfer and transferFrom functions refuse to send tokens to one stored address, newun. The first transferFrom call made while newun is empty records its recipient as newun; when that call is the first liquidity deposit, the recipient is the trading pair. From then on a router-based sell, which is a transferFrom into the pair, reverts with "please wait" unless the sender is delegate1 or delegate2, two addresses the owner can set.
De.Fi's REKT database lists the token as an exit scam/honeypot in which the owner could disable transfers and so restrict users from selling; no sale attempt, transaction or loss figure was opened for this record.
How it happened
What the code allows:
transferFrombegins withif(from != address(0) && newun == address(0)) newun = to;. The first call with a non-zerofromwhilenewunis unset stores its recipient asnewunand skips the check below. A liquidity deposit through a router is such a call, sonewunwould be the pair address.- Every later
transferFromrunselse require(to != newun || (from == delegate1 && to == newun) || (from == delegate2 && to == newun), "please wait");. A holder selling through a router callstransferFrom(holder, pair, amount), soto == newunand the call reverts unlessfromisdelegate1ordelegate2. transfercontainsrequire(to != newun, "please wait");with no exemption, so a direct transfer tonewunalso reverts for every sender, including the delegates.- Transfers out of the pair to a buyer have
toequal to the buyer, notnewun, so they are not blocked by these checks. Buying stays possible while selling throughnewunis blocked. - The owner controls the exemptions.
transferdelegate1(address _delegate1, uint256 tokens)isonlyOwner, setsdelegate1, and also runs_totalSupply = _totalSupply.add(tokens)andbalances[_delegate1] = balances[_delegate1].add(tokens), so it mints new tokens to that address.transferdelegate2(address)andtransfernewun(address)are alsoonlyOwner. Settingnewunto zero re-arms the capture on the nexttransferFrom; pointing it at an unused address lifts the block. clearCNDAO()isonlyOwnerand sends the contract's ETH balance to the caller.
De.Fi's REKT database lists Kyushu Inu as an exit scam/honeypot dated 2021-06-06 in which holders were restricted from selling. No transaction showing a failed sale, a use of transfernewun, transferdelegate1 or transferdelegate2, or a liquidity removal was opened for this record.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.