Universe of Inu Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Universe of Inu (uInu) is an ERC-20 token on Ethereum, deployed on 5 June 2021, built from a known honeypot template. Its transfer check lets the owner, the owner's chosen _safeOwner address and whitelisted wallets move tokens freely, but any other holder's transfer reverts with a fake ERC20: transfer amount exceeds balance error unless it goes to the Uniswap V2 router address or is smaller than an owner-set _sellAmount, which starts at zero. A Uniswap sale sends tokens from the holder to the pair, not to the router, so ordinary holders cannot sell.

The owner can also whitelist or blacklist any address, and a public _mint lets the owner create new tokens; the contract has no function to give up ownership. De.Fi's REKT database lists Universe of Inu as an exit scam/honeypot; no transaction evidence of losses was found.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner and mints the supply. Both _mint calls credit _balances[_owner], even the one whose Transfer event names 0x15D60499…57e3b8, and require(msg.sender == _owner, ...) inside _mint means the owner must be the deployer.
  2. The owner's first outgoing transfer runs if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. If that transfer is the liquidity deposit, the Uniswap pair becomes _safeOwner, and transfers out of the pair (buys) pass.
  3. For any other sender that is not whitelisted, the burnTokenCheck modifier allows the transfer only if the amount is below _sellAmount or require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance") passes. A sale through the router moves tokens from the holder to the pair, so it reverts.
  4. The owner can open a narrow exit by sending tokens to itself, which sets _sellAmount. A holder who then sells a smaller amount to _safeOwner is added to _blackAddress, after which only transfers to the router address pass for them.
  5. increaseAllowance(address[]) whitelists addresses, and multiTransfer sends tokens to chosen wallets, whitelists them and pre-approves the router for them, so wallets the owner picks can sell while everyone else cannot. addApprove(address[]) blacklists addresses, and _mint adds new tokens to the owner's balance.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract uInu

Evidence

Same attack technique

Browse all hacks →
Ethereum Misa Inu Loss not disclosed Ethereum Nemo Inu Loss not disclosed Ethereum Houbi Arena Loss not disclosed BNB Chain NFT.Music Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes