SPACEDOGE Honeypot
What happened
SPACEDOGE is a BEP20 token on BNB Smart Chain whose transfer and transferFrom refuse any move into one stored address, newun. The first transferFrom call made while newun is unset stores that call's recipient there, and the owner can also change it with transfernewun. If the stored address is the liquidity pool, buying still works but sending tokens into the pool, which is what a sell does, reverts with "please wait".
De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the contract owner could disable the transfer function, restricting users from selling their tokens.
How it happened
transferFromopens withif(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zerofromwhilenewunis empty stores its recipient innewunand skips the check. The code does not say which address that is; if the first such call is the liquidity deposit,newunbecomes the pool.transfercontainsrequire(to != newun, "please wait");and theelsebranch oftransferFromapplies the same test, so every later transfer intonewunreverts.- A sell sends the token into the pool, so with
newunpointing at the pool it fails. Buys move tokens out of the pool to a buyer whose address is notnewun, so they pass, and the holder's balance is only debited when the transfer succeeds. transfernewun(address _newun) public onlyOwnerlets the owner rewritenewun. Setting it to the zero address re-arms capture on the nexttransferFromwith a non-zerofrom; pointing it at an unused address would lift the block.- What happened: De.Fi's REKT database lists this token as a honeypot/exit scam. No transaction showing the owner changing
newun, removing liquidity, or any holder's failed sell was opened, and no loss figure is given.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.