Umbrella Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Umbrella ($UBL$) is a BNB Chain token deployed on 1 May 2021 at 0x143ce61a…13daef. Its transferFrom stores the recipient of the first delegated transfer in a variable called newun, and both transfer and transferFrom then revert with "please wait" for any transfer to that address. When liquidity is added through the PancakeSwap router, that first transferFrom sends tokens to the new pair, so the pair itself becomes newun: holders can buy, because the pair sends tokens out, but any sale back into the pair fails.

The owner can point newun at another address with transfernewun, but cannot switch the block off: setting it to the zero address only re-arms the capture, so the recipient of the next delegated transfer becomes the new blocked address. De.Fi's REKT database lists Umbrella as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling; its proof links describe the same newun block on earlier tokens.

How it happened

  1. The constructor mints the whole supply of 100,000,000 $UBL$ (9 decimals) to the deployer, who is also owner.
  2. On the first transferFrom with a non-zero from, newun is still the zero address, so the contract sets newun = to and lets the transfer through. A router liquidity add performs this call with the pair as to.
  3. From then on, transferFrom runs require(to != newun, "please wait"), so a router sale (transferFrom(holder, pair, amount)) reverts.
  4. transfer has the same require(to != newun, "please wait"), so sending tokens straight to the pair also fails. Buys are unaffected because the pair transfers tokens to the buyer, not to itself.
  5. Only the owner can change the blocked address through transfernewun(address). The contract has no renounce function; ownership can only move through transferOwnership and acceptOwnership.
  6. clearCNDAO() lets the owner withdraw any BNB held by the token contract.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract UBL

Evidence

Same attack technique

Browse all hacks →
Ethereum makiswap.com Loss not disclosed Ethereum Bring.finance Loss not disclosed Ethereum London X Protocol Loss not disclosed Ethereum Oportunity Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes