TheCatToken.com Honeypot

What happened

TheCatToken.com (CAT) reverts any transfer or transferFrom whose recipient equals a stored address called newun, with the message "please wait". The first transferFrom with a non-zero sender sets newun to its own recipient, and the owner can overwrite it with transfernewun. If newun is a liquidity pair, holders cannot sell into it.

De.Fi's REKT database lists the token as an exit scam/honeypot in which the owner could disable the transfer function, restricting users from selling.

How it happened

1. The constructor mints the full 10,000,000 supply to the deployer: balances[owner] = _totalSupply;.
2. transfer begins with require(to != newun, "please wait");, so nothing can be sent to the newun address.
3. transferFrom runs if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first such call passes and stores its recipient as newun; every later call to that recipient reverts.
4. The cryptot3ddybear.gitlab.io write-up describes this pattern as a stealthy liquidity-pool block: the pool becomes newun when liquidity is added, buys from it still work and sells back to it fail. This record's code does not show which address newun ended up as.
5. The owner can call transfernewun(address _newun) to change the blocked address. Setting zero re-arms the capture on the next transferFrom; pointing it at an unused address lifts the block.
6. A reverted sell does not debit the holder, because balances[msg.sender].sub(tokens) runs after the require; the tokens remain in the wallet.

Protocol details

Classification Yield Aggregator

Protocol Type Exit Scam/Honeypot

Affected asset / contract CAT

Evidence

• report De.Fi REKT database listing (proof: Token Sniffer tweet 1381346761566916614, not retrievable) twitter.com
• address BscScan code page for 0x34e5fff253a8b3056e2f6295e05feb246ec27e40 bscscan.com
• analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
• analysis Sourcify copy of the same contract repo.sourcify.dev