SpaceGoat Honeypot

What happened

SpaceGoat's contract stores one address in newun and refuses every transfer that sends tokens to it, with the message "please wait". The first transferFrom call stores its recipient there automatically; a liquidity addition through a router is such a call, so the pool address can end up stored. A holder's sell then reverts before their balance is debited, so the tokens stay in the wallet but cannot be sold.

De.Fi's REKT database lists SpaceGoat as an exit scam/honeypot on BNB Smart Chain dated 2021-05-23 and states that the owner could disable the transfer function, restricting users from selling.

How it happened

1. The constructor mints the whole supply to the deployer: _totalSupply = 1000000000000000; and balances[owner] = _totalSupply;, with decimals = 0.
2. The contract has a storage variable address public newun; that starts as the zero address. In transferFrom, the first call with a non-zero from stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. A router liquidity addition moves tokens to the pool with transferFrom, so that call can store the pool address. The code alone does not show which address newun holds on-chain.
3. After that, both transfer paths reject any recipient equal to newun: else require(to != newun, "please wait"); in transferFrom and require(to != newun, "please wait"); in transfer. A router sell calls transferFrom(holder, pool, amount), so to == newun and the call reverts before balances[from] = balances[from].sub(tokens); runs. The holder keeps the tokens but cannot sell them. Buys pay out from the pool to the buyer, whose address is not newun, so they pass.
4. The deployer, as owner, can change the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address lets the next transferFrom capture a new recipient. The Owned contract has no renounce function, only transferOwnership and acceptOwnership.
5. What happened: De.Fi's REKT database lists the token as a honeypot. No transaction showing the block applied to holders, a transfernewun call, or a liquidity removal was opened for this record.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract SpaceGoat

Evidence

• report @Token_Sniffer incident report twitter.com
• address BscScan verified source, SpaceGoat 0xbc5e2cba56de5018b30e329fbb69b1269c407883 bscscan.com
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
• analysis Sourcify match, chain 56 repo.sourcify.dev