What happened
Pigg Token's code includes a transfer lock keyed to a stored address called newun. The first transferFrom call records its recipient as newun; afterwards any transfer or transferFrom to that address reverts with "please wait". If the stored address is the liquidity pair, holders can receive tokens from it but cannot sell back.
The hard-coded owner can change newun with transfernewun, so the lock can be re-armed or lifted at will. De.Fi's REKT database lists Pigg as an Exit Scam/Honeypot on BNB Chain dated 2021-05-27, stating the contract owner could disable the transfer function, which restricted users in selling their tokens. No loss figure is given.
How it happened
- The
Ownedconstructor hard-codes the owner (owner = 0xF110D818607313bd5C59DE257258134B7f1fE241;), the same address that deployed the contract, and the token constructor assigns the full supply to it:balances[owner] = _totalSupply;. - In
transferFrom, the first call by a non-zerofromwhilenewunis empty stores the recipient:if(from != address(0) && newun == address(0)) newun = to;. That call is not blocked. - Every later call takes the other branch:
else require(to != newun, "please wait");, andtransferhasrequire(to != newun, "please wait");. Any transfer tonewunreverts. - If the first
transferFromrecipient was the liquidity pair (the pattern the cited Cryptot3ddybear write-up describes for this template), a holder's swap, which moves tokens into the pair viatransferFrom(holder, pair, amount), reverts. Tokens leaving the pair to a buyer are not checked. The code does not show which addressnewunholds on-chain. - The owner can call
transfernewun(address _newun)(onlyOwner). Setting it toaddress(0)re-arms capture on the nexttransferFrom; pointing it at an unused address lifts the block.clearCNDAOalso lets the owner withdraw any BNB held by the token contract. No transaction was opened showing the owner calling either function, or any holder failing to sell; the sell restriction is stated by the De.Fi listing.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
