PIDGEY Honeypot
What happened
PIDGEY (PGY) is a BNB Chain token whose verified source keeps an address in newun and reverts any transfer to it with the message "please wait". The first transferFrom call with a non-zero from sets newun to that call's recipient, and every later transferFrom and every transfer to that address fails. If that first recipient is the liquidity pair, a holder's sell into the pair fails whatever the holder's balance is, while the owner can repoint the block with transfernewun.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-12 and says the owner could disable the transfer function, which restricted users in selling their tokens; the listing gives no loss figure. A write-up of the same code pattern on other BNB Chain tokens describes the first transferFrom during the liquidity add as the call that stores the pair. No transaction was opened to show which address newun holds for this token.
How it happened
- The constructor sets
symbol = "PGY",name = "PIDGEY",decimals = 18and credits_totalSupply = 10000000000e18to the deployer withbalances[owner] = _totalSupply;. Theowneris hard-coded as 0xFb2466eC…552A26.newunstarts empty. - The first
transferFromwhosefromis non-zero whilenewunis still empty succeeds and stores its recipient:if(from != address(0) && newun == address(0)) newun = to;. The code does not say who that recipient is; in a router-based liquidity add it would be the pair. - Every later
transferFromrunselse require(to != newun, "please wait");and everytransferrunsrequire(to != newun, "please wait");. A router sells by callingtransferFrominto the pair, so a sell to the stored address reverts. transfernewun(address _newun) public onlyOwnerlets the owner overwritenewun. Setting it to the zero address re-arms the capture on the nexttransferFromwith a non-zerofrom; pointing it at an unused address lifts the block.owneris moved only throughtransferOwnershipandacceptOwnership; the code has no renounce function.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address BscScan verified source, PGY 0x3f919a00d130f08b3efbfe7c78a35b9178acdc2e bscscan.com
- analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io
- analysis Sourcify match, chain 56, PGY repo.sourcify.dev
- analysis De.Fi REKT database listing for PGY (Exit Scam/Honeypot, 2021-05-12) de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.