PLANET Honeypot
What happened
PLANET (symbol Planetarium) is an Ethereum token at 0xe6e59a25…848aca, deployed on 10 April 2021 by 0x79Cc5F11…ACAA87, which received the whole supply and is still the owner. Its code comment advertises a 1% holder reflection and a 1% burn, but the code has no fees at all. Instead, the first transferFrom call, normally the router moving the owner's tokens into the new Uniswap pair when liquidity is added, saves the recipient as newun, and every later transfer to that address reverts with "please wait".
Holders can buy from the pair, but any sale, which must send tokens to the pair, fails. De.Fi's REKT database lists PLANET as an exit scam/honeypot and says the owner could disable transfers so that users could not sell.
How it happened
- The constructor credits the entire 1,000,000,000,000 PLANET (8 decimals) to the deployer, who is
owner. - In
transferFrom, the lineif(from != address(0) && newun == address(0)) newun = to;records the first recipient. When the owner adds liquidity, that recipient is the Uniswap pair. - From then on,
transferFromandtransferboth runrequire(to != newun, "please wait"), so any transfer into the pair reverts. - Buying still works because the pair calls
transferto the buyer, but selling requires sending PLANET to the pair, so every holder's sale reverts with "please wait". - The owner can move the block with
transfernewun(address), for example to reopen trading, and ownership can only be handed over throughtransferOwnershipplusacceptOwnership; there is no renounce function. - De.Fi's REKT database lists PLANET as an exit scam/honeypot in which users could not sell; no transaction was opened showing trades or liquidity removal.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report Token Sniffer post 1381346761566916614 (De.Fi proof link) twitter.com
- transaction PLANET contract creation transaction etherscan.io
- address PLANET (Planetarium) verified contract code on Etherscan etherscan.io
- analysis Sourcify match for 0xe6e59a25688574bab6ae7cd1f48e5d92f7848aca on Ethereum repo.sourcify.dev
- analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.