Sushi Finance Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Sushi Finance (SUSHI) is a BEP-20 token on BNB Smart Chain whose transfer functions reject any transfer to a stored address called newun. That address is set automatically by the first transferFrom call and can also be set by the owner, so once it points at the liquidity pair, sells routed to the pair revert with "please wait". De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens.

De.Fi gives no loss figure.

How it happened

  1. The contract declares address public newun;, which is the zero address after deployment.
  2. transfer contains require(to != newun, "please wait");, so no transfer can go to the newun address.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. The first call made while newun is unset succeeds and stores its recipient as newun. A blog post on this code pattern says that call is the one that adds liquidity on PancakeSwap, which makes newun the liquidity pair.
  4. Every later transferFrom runs else require(to != newun, "please wait");. A router sell pulls the holder's tokens to the pair with transferFrom, so it would revert if newun is the pair. Buys send tokens out of the pair and are not blocked by this check.
  5. The owner can change the block with function transfernewun(address _newun) public onlyOwner. Setting newun to the zero address makes the next transferFrom store a new recipient; pointing it at an unused address lifts the block. The source does not show whether or when the owner called it.
  6. De.Fi's REKT database lists the token as Exit Scam/Honeypot. No transaction or loss amount was opened, so what holders actually lost is not established here.

Protocol details

Classification Exchange (DEX) / Borrowing and Lending
Protocol Type Exit Scam/Honeypot
Affected asset / contract SUSHI

Evidence

Same attack technique

Browse all hacks →
Ethereum Moon Fox Community Loss not disclosed BNB Chain Atomas Loss not disclosed BNB Chain XenonFinance Loss not disclosed Ethereum Rao Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes