WOO Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

This WOO token's contract stores one address in newun and refuses every transfer that sends tokens to it, with the message "please wait". The first transferFrom call stores its recipient there automatically; a liquidity addition through a router is such a call, so the pool address can end up stored. A holder's sell then reverts before their balance is debited, so the tokens stay in the wallet but cannot be sold.

De.Fi's REKT database lists WOO as an exit scam/honeypot on BNB Smart Chain dated 2021-05-23 and states that the owner could disable the transfer function, restricting users from selling.

How it happened

  1. The constructor mints the whole supply to the deployer: _totalSupply = 1000000000000; and balances[owner] = _totalSupply;, with decimals = 0.
  2. The contract has a storage variable address public newun; that starts as the zero address. In transferFrom, the first call with a non-zero from stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. A router liquidity addition moves tokens to the pool with transferFrom, so that call can store the pool address. The code alone does not show which address newun holds on-chain.
  3. After that, both transfer paths reject any recipient equal to newun: else require(to != newun, "please wait"); in transferFrom and require(to != newun, "please wait"); in transfer. A router sell calls transferFrom(holder, pool, amount), so to == newun and the call reverts before balances[from] = balances[from].sub(tokens); runs. The holder keeps the tokens but cannot sell them. Buys pay out from the pool to the buyer, whose address is not newun, so they pass.
  4. The deployer, as owner, can change the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address lets the next transferFrom capture a new recipient. The Owned contract has no renounce function, only transferOwnership and acceptOwnership.
  5. What happened: De.Fi's REKT database lists the token as a honeypot. No transaction showing the block applied to holders, a transfernewun call, or a liquidity removal was opened for this record.

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Honeypot
Affected asset / contract WOO

Evidence

Same attack technique

Browse all hacks →
BNB Chain HolyMoon Loss not disclosed BNB Chain BSCstarter Loss not disclosed BNB Chain SpaceGoat Loss not disclosed BNB Chain Auditore Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes