LURNA Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

LURNA is a BEP20 token on BNB Smart Chain, deployed at 0x902c5e16…bcb7d5 in transaction 0x68b2e111…0860d3 on 2021-04-14. Its transfer and transferFrom revert with "please wait" whenever the recipient equals a stored address called newun, and the first transferFrom made while newun is empty records that call's recipient as newun. If that first call is the router moving tokens into the trading pair when liquidity is added, the pair becomes the one address nobody can send tokens to, and a DEX sell is exactly a transfer to the pair.

The owner can also reassign newun with transfernewun. De.Fi's REKT database lists LURNA as an Exit Scam/Honeypot.

How it happened

  1. The constructor gives the whole supply, 1000000000000000000000000000000000 raw units (10^15 tokens at 18 decimals), to the deployer: balances[owner] = _totalSupply;.
  2. While newun is the zero address, the first transferFrom call with a non-zero from stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. That transfer goes through. If it is the router pulling tokens into the pair during the liquidity add, newun becomes the pair address; the code does not say which call comes first, and no transaction was opened for this token.
  3. From then on both entry points reject any transfer into newun: else require(to != newun, "please wait"); in transferFrom and require(to != newun, "please wait"); in transfer. A holder's sell through a router is transferFrom(holder, pair, amount), so it reverts and the holder's balance is not debited.
  4. The check only looks at the recipient, so a pair sending tokens out to a buyer is not stopped by this line.
  5. The owner controls the switch: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address lets the next transferFrom capture a new recipient. Nothing in the source limits how often this can change.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract LURNA

Evidence

Same attack technique

Browse all hacks →
Ethereum Disbalancer Loss not disclosed BNB Chain MOONCALENDA Loss not disclosed Ethereum Apron Network Loss not disclosed BNB Chain icecreamland.org Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes