NYAN INU Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

NYAN INU (NYINU) is a 9-decimal token on Ethereum whose transfer and transferFrom both revert when the recipient equals a stored address called newun. newun starts empty and is filled by the first transferFrom call, which stores that call's recipient. If the first transferFrom is the liquidity deposit through a router, the liquidity pair becomes newun and every later sale into the pair reverts with please wait, while purchases out of the pair are not restricted.

The owner can also repoint newun with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. The header comment promises 5% of every transaction to holders, but the code contains no fee or reflection logic.

How it happened

  1. The constructor credits the whole supply to the deployer: balances[owner] = _totalSupply; with _totalSupply = 1000000000 * 10**6 * 10**9 raw units at 9 decimals. newun is never set in the constructor, so it starts as the zero address.
  2. The first transferFrom from a non-zero sender takes this branch: if(from != address(0) && newun == address(0)) newun = to;. That transfer succeeds and its recipient is stored as newun. A router-based liquidity deposit calls transferFrom from the owner to the pair, so the code allows the pair to become newun.
  3. Every later call is checked against newun. transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. A sale through a router calls transferFrom(holder, pair, amount), so the recipient equals newun and the call reverts. Buys are transfer calls from the pair to the buyer, whose recipient is not newun, so they go through.
  4. The check has no exception for the owner or any whitelist, so it applies to every sender. The owner alone can change it with function transfernewun(address _newun) public onlyOwner. Pointing newun at an unused address lifts the block; setting it back to zero re-arms the capture, and the next transferFrom passes and stores its recipient.
  5. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. A blog post dated 2021-04-11 documents the same newun pattern in other tokens (SafeRocket and similar), where the pair is captured during the first liquidity add; it does not mention NYAN INU, and no transaction for this token was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NYINU

Evidence

Same attack technique

Browse all hacks →
Ethereum Charged Particles Protocol Loss not disclosed BNB Chain PandoraBSC Loss not disclosed Ethereum EA Sports Token Loss not disclosed Ethereum Ethereum SHIBA Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes