NyanCat Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NyanCat (NyanCat) is a BEP-20 token on BNB Smart Chain at 0xe684bb37…09fb62. 0x912e16d7…49701b deployed it on 3 May 2021 and received the whole 1,000,000,000,000 NyanCat supply. The first transferFrom from a non-zero address records its recipient in a variable named newun.

When the owner adds PancakeSwap liquidity, that recipient is normally the liquidity pool. After that, every transfer or transferFrom whose recipient is newun reverts with "please wait". Buys, where the pool sends tokens out, still work, but holders cannot sell into the pool.

The owner can repoint newun at any address with transfernewun. This is the stealthy liquidity-pool block that the blogger cryptot3ddybear described on 11 April 2021 for other BSC tokens using the same code.

How it happened

  1. The constructor credits the whole supply to the deployer: balances[owner] = _totalSupply;.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. While newun is unset, the first transferFrom from a real address stores its recipient. When the owner adds liquidity through the PancakeSwap router, the router pulls tokens with transferFrom into the pair, so the pair becomes newun.
  3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer runs require(to != newun, "please wait");. Router sells move tokens to the pair with transferFrom, and direct sends to the pair use transfer, so both revert.
  4. Transfers out of the pair are not checked, so buyers can keep buying while the pool fills with BNB they cannot get back by selling.
  5. transfernewun(address _newun) public onlyOwner lets the owner change the blocked address at any time. Removing liquidity does not send tokens to the pair, so whoever holds the LP tokens can still withdraw the pool's BNB.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NyanCat

Evidence

Same attack technique

Browse all hacks →
BNB Chain PAIRS Loss not disclosed BNB Chain INFINITE SPACE Loss not disclosed Ethereum Tibetan Mastiff Protocol Loss not disclosed Ethereum SpaceX Network Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes