PIDGEY Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

PIDGEY (PGY) is a BNB Chain token whose verified source keeps an address in newun and reverts any transfer to it with the message "please wait". The first transferFrom call with a non-zero from sets newun to that call's recipient, and every later transferFrom and every transfer to that address fails. If that first recipient is the liquidity pair, a holder's sell into the pair fails whatever the holder's balance is, while the owner can repoint the block with transfernewun.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-12 and says the owner could disable the transfer function, which restricted users in selling their tokens; the listing gives no loss figure. A write-up of the same code pattern on other BNB Chain tokens describes the first transferFrom during the liquidity add as the call that stores the pair. No transaction was opened to show which address newun holds for this token.

How it happened

  1. The constructor sets symbol = "PGY", name = "PIDGEY", decimals = 18 and credits _totalSupply = 10000000000e18 to the deployer with balances[owner] = _totalSupply;. The owner is hard-coded as 0xFb2466eC…552A26. newun starts empty.
  2. The first transferFrom whose from is non-zero while newun is still empty succeeds and stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. The code does not say who that recipient is; in a router-based liquidity add it would be the pair.
  3. Every later transferFrom runs else require(to != newun, "please wait"); and every transfer runs require(to != newun, "please wait");. A router sells by calling transferFrom into the pair, so a sell to the stored address reverts.
  4. transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Setting it to the zero address re-arms the capture on the next transferFrom with a non-zero from; pointing it at an unused address lifts the block.
  5. owner is moved only through transferOwnership and acceptOwnership; the code has no renounce function.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PGY

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.