WeSpace Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

WeSpace is a BEP20 token on BNB Smart Chain whose transfer and transferFrom functions share a hidden address variable, newun. The first transferFrom call made while newun is empty stores that call's recipient in newun, and every later transfer or transferFrom to that address reverts with "please wait". The owner can also overwrite newun at any time with transfernewun.

De.Fi's REKT database lists WeSpace as an Exit Scam/Honeypot in which the contract owner could disable transfers and so restrict holders from selling.

How it happened

  1. The constructor mints the whole supply (_totalSupply = 100000000000000000, 9 decimals) to the deployer, who becomes owner.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait"); runs. While newun is still the zero address, the first transferFrom stores its recipient in newun. Routers pull tokens with transferFrom, so a first liquidity-adding call would record whatever address received the tokens. The code does not show which address that was.
  3. Once newun is set, every later transferFrom whose recipient equals newun hits require(to != newun, "please wait") and reverts. transfer has the same check on its first line, require(to != newun, "please wait");.
  4. If newun is the trading pair, a holder's sell, which moves tokens to the pair, reverts. Buying is not covered by this check. Sending tokens to any other address still works.
  5. The owner can call transfernewun(address _newun) (marked onlyOwner) to point newun at any address. Pointing it at an unused address lifts the block, and setting it back to address(0) lets the next transferFrom re-capture a recipient. The contract has no function that removes or caps the check, and the code shows no ownership renounce function.
  6. The same contract has clearCNDAO(), which sends the contract's own BNB balance to the owner. The token itself is not drained by it.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WeSpace

Evidence

Same attack technique

Browse all hacks →
BNB Chain Chava Loss not disclosed BNB Chain Capellix Loss not disclosed BNB Chain NoCapCoin Loss not disclosed BNB Chain DoubtFire Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes