Pudgy Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Pudgy Token (PUDGY) is a BNB Chain token deployed on 25 April 2021 at 0xca1cd767…c0c28a. Its transferFrom stores the recipient of the first delegated transfer in a variable called newun, and both transfer and transferFrom then revert with "please wait" for any transfer to that address. When liquidity is added through the PancakeSwap router, that first transferFrom sends tokens to the new pair, so the pair becomes newun: holders can buy, because the pair sends tokens out, but any sale back into the pair fails.

The owner can point newun at another address with transfernewun, but cannot switch the block off: setting it to the zero address only re-arms the capture, so the recipient of the next delegated transfer becomes the new blocked address. De.Fi's REKT database lists Pudgy Token as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling; its proof links describe the same newun block on earlier tokens.

How it happened

  1. The constructor mints the whole supply of 100,000,000,000 PUDGY (0 decimals) to the deployer, who is also owner.
  2. On the first transferFrom with a non-zero from, newun is still the zero address, so the contract sets newun = to and lets the transfer through. A router liquidity add performs this call with the pair as to.
  3. From then on, transferFrom runs require(to != newun, "please wait"), so a router sale (transferFrom(holder, pair, amount)) reverts.
  4. transfer has the same check, so sending tokens straight to the pair also fails. Buys are unaffected because the pair transfers tokens to the buyer.
  5. Only the owner can change the blocked address through transfernewun(address). The contract has no renounce function; ownership can only move through transferOwnership and acceptOwnership.
  6. clearCNDAO() lets the owner withdraw any BNB held by the token contract.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PUDGY

Evidence

Same attack technique

Browse all hacks →
Ethereum Ares Protocol Loss not disclosed BNB Chain BullsDrop Loss not disclosed Ethereum Floyd Crypto Mayweather Loss not disclosed BNB Chain SATANS PLAYHOUSE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes