Pug Token Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Pug Token (PUG) on Ethereum, contract 0x0d5be6ed…0400c5, blocks transfers to a stored address named newun. The first transferFrom call while newun is empty stores its recipient there, and from then on every transfer or transferFrom to that address reverts with "please wait". If that address is a trading pool, holders cannot sell into it.

The owner can reassign newun at any time with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-19; its text speaks of disabling the transfer function, which the code does through this recipient block.

How it happened

  1. The constructor sets the symbol to PUG and mints _totalSupply = 1000000000000000000000000000000 (10^30 units, 10^12 tokens at 18 decimals) to the deployer, which is also the owner.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call made while newun is the zero address records the recipient as newun and goes through; after that every transferFrom whose to equals newun reverts.
  3. transfer has the same check, require(to != newun, "please wait");, so a direct transfer to newun also reverts.
  4. The blog post cited in the listing describes this pattern in other tokens: newun is set to the liquidity pool address when liquidity is first added, after which swaps back to the pool fail. If that happened here, sells would fail while buys, which are transfers from the pool, would still pass. The code alone does not show which address newun holds.
  5. transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Setting it to address(0) makes the next transferFrom store a new recipient; pointing it at an unused address lifts the block.
  6. clearCNDAO is onlyOwner and sends the contract's own ETH balance to the owner. The token's fallback function() external payable {} accepts ETH, so ETH sent to the token address can be withdrawn by the owner.
  7. What happened: the supplied sources do not show sale attempts, losses or liquidity removal for this token. De.Fi's REKT database lists it as an Exit Scam/Honeypot on 2021-04-19.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PUG

Evidence

Same attack technique

Browse all hacks →
Ethereum Plethori Loss not disclosed Ethereum Dehive.finance Loss not disclosed BNB Chain DirtyPig Loss not disclosed BNB Chain Nova Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes