Wu-Tang Financial Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Wu-Tang Financial (WUFI) is an Ethereum token whose transfers run through a burnTokenCheck modifier. The owner, a _safeOwner address, owner-whitelisted addresses and transfers into the owner pass freely. For other holders, the default path is a require that lets a transfer through only when the recipient is the Uniswap V2 router address hard-coded as _unirouter; otherwise it reverts with "ERC20: transfer amount exceeds balance".

A sell through a trading pair goes to the pair rather than the router, so by default it reverts for an ordinary holder. The owner can change this: a self-transfer by the owner sets _sellAmount, and after that a transfer from an ordinary holder with a smaller amount can pass without going to the router. The constructor also calls _mint eleven times, and the code credits all of that supply to _balances[_owner].

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the contract owner could restrict users from selling.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument and calls _mint eleven times with initialSupply*(10**18). Each call emits a Transfer event to one of six distinct listed addresses (one address appears five times, another twice, and four appear once), but _mint adds the amount to _balances[_owner], so by the code all minted supply sits in the owner's balance.
  2. Every transfer and transferFrom goes through _approveCheck, which carries the modifier burnTokenCheck(sender,recipient,amount).
  3. In the modifier, a sender that is _owner while _owner == _safeOwner passes and _safeOwner is set to the recipient. After that, a transfer passes if sender == _owner || sender == _safeOwner || recipient == _owner; inside that branch, if sender == _owner && sender == recipient it also sets _sellAmount = amount. So once _safeOwner has moved off the owner, the owner can set _sellAmount with a self-transfer.
  4. For any other sender, a whitelisted sender (_whiteAddress[sender] == true) can transfer to any recipient. A blacklisted sender passes only if sender == _safeOwner or recipient == _unirouter.
  5. A sender that is neither whitelisted nor blacklisted is checked against _sellAmount, which starts at 0, so amount < _sellAmount is false at first. The code then reaches require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance");, which reverts unless the recipient is the router (the owner as recipient was already allowed in step 3). If the owner has set _sellAmount, a transfer with amount < _sellAmount can pass with no router requirement, and the sender is blacklisted and removed from the whitelist only if recipient == _safeOwner. A transfer with amount >= _sellAmount still faces the router require.
  6. A sell through a pair is a transferFrom(holder, pair, amount). The recipient is the pair, so by default, for a holder who is not whitelisted, the call reverts and the balance is not debited. Whether a given sell can pass depends on whether the owner has set _sellAmount and whether amount is below it. Buys, where the pair is the sender, can only pass if the pair is _safeOwner or whitelisted, or if the _sellAmount path applies; the source does not show which address the pair was or what _sellAmount was set to.
  7. The owner controls the lists: increaseAllowance whitelists, addApprove blacklists, decreaseAllowance(address safeOwner) sets _safeOwner, and multiTransfer whitelists the first approvecount receivers. The names do not describe what these functions do.
  8. _mint is public and gated only by require(msg.sender == _owner, ...), so the owner can add supply to its own balance later. The source alone does not show whether this was done.
  9. What happened on-chain (sell attempts, liquidity removal, losses, any _sellAmount value) was not established by the opened sources. De.Fi's REKT database lists the token as a honeypot.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WUFI

Evidence

Same attack technique

Browse all hacks →
BNB Chain NFTLogy Loss not disclosed BNB Chain NeptuneWallet Loss not disclosed Ethereum Diamond Hands Inu Loss not disclosed BNB Chain SaintElon Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes