What happened
Wolfy (WYT) is a BEP-20 token on BNB Chain, deployed on 18 June 2021, built from a known "liquidity pool block" template. The first transferFrom, which normally happens when liquidity is added through the PancakeSwap router, stores the recipient (the new pair) in a variable named newun. After that, any transfer into newun from anyone except the owner reverts with please wait, so holders can buy from the pool but cannot sell into it.
The owner can also freeze every transfer not to or from the owner through a pause function misleadingly named rewardfee, repoint newun with transfernewun, and mint new WYT through a function misleadingly named burn. De.Fi's REKT database lists Wolfy as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor credits the full 10,000,000 WYT supply to the deployer, who is also the
owner. - When liquidity is first added, the router calls
transferFrom(owner, pair, ...); becausenewunis still empty,if(sender != address(0) && newun == address(0)) newun = recipient;records the pair, and the transfer passes because the sender is the owner. - Buys move tokens out of the pair, which
_transferallows, so purchases succeed. - A sale moves tokens into the pair, so
require(recipient != newun || sender == owner(), "please wait")reverts it for every holder except the owner, whether throughtransferor the router'stransferFrom. - The owner also holds three more switches:
rewardfee()setspaused = true, after whichrequire(!paused || sender == owner() || recipient == owner(), "paused")blocks all other transfers;transfernewuncan point the block at any address; andburn(address _to, uint256 _amount)adds tokens to any balance and to the total supply.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
