Q DAO Governance token v2.0 Honeypot

Reported loss $3K
BNB Chain
Honeypot

What happened

Q DAO Governance token v2.0 (QDAO) is a BNB Chain token deployed on 26 March 2021 at 0xa219a553…b686f2 by 0x865027ad…104511. Its transferFrom stores the recipient of the first transferFrom call in a variable called newun and then rejects every later transferFrom or transfer to that address with the message "please wait". Adding liquidity through the PancakeSwap router is normally that first call, so newun becomes the pair: buyers can receive QDAO from the pool, but any sale into the pool reverts.

The owner can also point newun at any address with transfernewun. De.Fi's REKT database lists QDAO as a honeypot with $2,544 lost and says the deployer added liquidity in transaction 0x31fa716c…c54e14 and removed it in 0x3ae83336…b0c2ea. A researcher documented the same newun code in other BSC honeypot tokens in April 2021.

How it happened

  1. The constructor credits the full 30,000 QDAO supply to the deployer, who is owner; newun starts as the zero address.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; saves the recipient of the first transferFrom as newun. When the owner adds liquidity through the router, the router moves tokens with transferFrom(owner, pair, ...), so the pair becomes newun.
  3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer starts with require(to != newun, "please wait");. A PancakeSwap sale sends tokens to the pair through transferFrom, so it reverts, while buys, where the pair sends tokens out with transfer, still work.
  4. transfernewun(address _newun) is onlyOwner, so the owner can change which address is blocked at any time. The contract has no renounceOwnership; ownership can only move through transferOwnership and acceptOwnership.
  5. Removing liquidity does not send QDAO to the pair, so the LP holder can still withdraw the pool's BNB. De.Fi reports that the deployer did so.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract QDAO

Evidence

Understand the attack patterns

Compare incidents →
DAO Governance Attacks

Same attack technique

Browse all hacks →
BNB Chain OMNI Loss not disclosed BNB Chain REFERRALPROJECT.NETWORK Loss not disclosed BNB Chain Tripod Dao Loss not disclosed Ethereum LinkPool Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes