Tripod Dao Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Tripod Dao (POD) is a BNB Smart Chain token with a hidden recipient block. transferFrom stores the recipient of its first call in newun, and from then on both transfer and transferFrom revert with "please wait" for any transfer to that address. If that first call was the one that added liquidity, the pool is the blocked recipient and sells into it fail, while a pool sending tokens to a buyer is not stopped by this check.

The owner can repoint newun with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-26, with the note that the owner could disable the transfer function and restrict users from selling.

How it happened

  1. The constructor sets the symbol to POD, gives the whole supply (50000000000000000 raw units, 8 decimals) to the deployer and leaves newun at the zero address.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first such call as newun, with no check on that call. If that call is the liquidity-adding transfer into a pool, newun becomes the pool address.
  3. Every later call hits require(to != newun, "please wait");, in transfer and in the else branch of transferFrom. The check has no exception for the owner or any other address.
  4. A holder who sells through a router approves it and the router calls transferFrom(holder, pool, tokens). If newun is the pool, to == newun and the call reverts, while transfers to any other address still work.
  5. transfernewun(address _newun) is onlyOwner, so the owner can move newun to an unused address (lifting the block) or back to the zero address (the next transferFrom then stores a new recipient). Which of these was ever done is not shown by the code.

The same code pattern is described, for other BNB Smart Chain tokens, as a way of blocking sells into the liquidity pool by an independent write-up; that write-up does not name this token, and no transaction for this token was opened, so what happened to holders is not established here.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract POD

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.