Treasure Box Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Treasure Box (TBOX) is an Ethereum token deployed on 22 April 2021 at 0xf67cb161…f91b56 by 0xf169e98a…EC18aF; Etherscan labels the contract Fake_Phishing230083. Its transferFrom saves the recipient of the first transferFrom call as newun; when liquidity is added through a router, that recipient is the pool. After that, every transfer or transferFrom into newun reverts with "please wait", so buys out of the pool work but no holder can sell into it.

Only the owner can change newun, through transfernewun, and removing liquidity sends tokens out of the pool, not into it, so it stays open. The contract has no renounceOwnership, and the header's claim that liquidity is locked for 365 days is not enforced anywhere in this code. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor mints the whole supply, 1,000,000,000,000 TBOX at 18 decimals, to the owner.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. When a router's add-liquidity call moves the owner's tokens into the pool with transferFrom, the pool becomes newun.
  3. From then on transferFrom runs require(to != newun, "please wait"), and transfer runs the same check. A router sale sends the seller's tokens into the pool, so it reverts; buys send tokens out of the pool and pass.
  4. transfernewun(address _newun) is onlyOwner, so only the owner can point newun elsewhere and reopen sales.
  5. Whoever holds the pool's LP tokens can remove liquidity at any time, because the pool paying out tokens is a transfer from newun, not to it. The blog post De.Fi cites describes this template's exit as pulling liquidity after one-way buying.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract TBOX

Evidence

Same attack technique

Browse all hacks →
Ethereum ULTRADOGE Loss not disclosed BNB Chain Quark Loss not disclosed BNB Chain CUMROCKET CRYPTO Loss not disclosed Ethereum Malamute Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes