The Doge Space X Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

The Doge Space X (DOGESPACEX) is an Ethereum token whose verified code contains an owner-controlled transfer block. The first transferFrom call made while newun is empty stores its recipient in newun; after that, every transfer or transferFrom whose recipient is newun reverts with the message "please wait". If newun holds the liquidity pair address, sells through that pair fail, while buys that move tokens out of the pair are not touched by the check.

Only the owner can change newun, through transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor sets symbol = "DOGESPACEX", name = "The Doge Space X" and assigns the whole _totalSupply of 10000000000000000000000000 raw units (1e17 whole tokens, 100 quadrillion, at 8 decimals) to owner.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; runs on the first call while newun is unset. It records the recipient of that call, whoever it is, and applies no check on that call.
  3. From then on the else branch runs: else require(to != newun, "please wait");. transfer has the same check, require(to != newun, "please wait");, so no caller, including the owner, can send tokens to newun.
  4. A swap that sells tokens pulls them with transferFrom(holder, pair, amount). If the pair is the address stored in newun, that call reverts and the holder's balance is not debited. The code does not show which address newun holds, so this is the case the pattern is built for rather than something the source proves.
  5. The owner can call transfernewun(_newun) at any time. Setting it to address(0) re-arms capture by the next transferFrom; pointing it at an address nobody uses lifts the block. Nothing in the source forces either.
  6. De.Fi's REKT database lists the token as an Exit Scam/Honeypot. The source contains no function that mints, blacklists or withdraws liquidity; clearCNDAO only sends the contract's own ETH balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract DOGESPACEX

Evidence

Same attack technique

Browse all hacks →
BNB Chain MoonSquirrel Loss not disclosed Ethereum TrustPad Loss not disclosed BNB Chain KimJongMoon Loss not disclosed BNB Chain SPACE GEM Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes