SpaceXDoge1 Honeypot
What happened
SpaceXDoge1 (SpacexDoge) is a BNB Chain token whose verified source keeps an address in newun and reverts any transfer to it with the message "please wait". The first transferFrom call with a non-zero from sets newun to that call's recipient, and every later transferFrom and every transfer to that address fails. If that first recipient is the liquidity pair, a holder's sell into the pair fails whatever the holder's balance is, while the owner can repoint the block with transfernewun.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-05-12 and says the owner could disable the transfer function, which restricted users in selling their tokens; the listing gives no loss figure. A write-up of the same code pattern on other BNB Chain tokens describes the first transferFrom during the liquidity add as the call that stores the pair. No transaction was opened to show which address newun holds for this token.
How it happened
- The constructor sets
symbol = "SpacexDoge",name = "SpaceXDoge1",decimals = 9and credits_totalSupply = 100000000000000000(raw units) to the deployer withbalances[owner] = _totalSupply;.newunstarts empty. - The first
transferFromwhosefromis non-zero whilenewunis still empty succeeds and stores its recipient:if(from != address(0) && newun == address(0)) newun = to;. The code does not say who that recipient is; in a router-based liquidity add it would be the pair. - Every later
transferFromrunselse require(to != newun, "please wait");and everytransferrunsrequire(to != newun, "please wait");. A router sells by callingtransferFrominto the pair, so a sell to the stored address reverts. transfernewun(address _newun) public onlyOwnerlets the owner overwritenewun. Setting it to the zero address re-arms the capture on the nexttransferFromwith a non-zerofrom; pointing it at an unused address lifts the block.owneris moved only throughtransferOwnershipandacceptOwnership; the code has no renounce function.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- address BscScan verified source, SpacexDoge 0x97595e4d83a5fe2ec3bfefb063668efdfa903abe bscscan.com
- analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io
- analysis Sourcify match, chain 56, SpacexDoge repo.sourcify.dev
- analysis De.Fi REKT database listing for SpacexDoge (Exit Scam/Honeypot, 2021-05-12) de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.