1Million Honeypot

What happened

1Million (MLN) is a BNB Chain token deployed on 6 June 2021 at 0x8034aa1e…7c8d81 by 0x930f1005…d506f3. Its transferFrom function reverts with "You are not the owner!" unless the tokens come from one hard-coded address, the deployer. Plain transfer works, so buyers can receive tokens from the PancakeSwap pair, but selling through the router uses transferFrom and therefore fails for every holder except the deployer.

The restriction is fixed in the code: there is no owner function to lift it and no ownership to renounce. De.Fi's REKT database lists 1Million as a honeypot; no loss figure is recorded.

How it happened

1. The constructor credits the deployer with the whole supply of 1,000 MLN (_totalSupply = 10000000 at 4 decimals).
2. The contract hard-codes address private _owner = 0x930f10051b16cB0272548BE9b151d9926ad506f3;, the deployer.
3. transfer has no restriction, so the pair can send MLN to buyers and holders can send MLN to each other.
4. transferFrom starts with require(from == _owner, "You are not the owner!");. A PancakeSwap sale has the router call transferFrom(seller, pair, amount), so it reverts for every seller except the deployer.
5. Only the deployer can sell through the router, and nothing in the contract can change _owner or remove the check.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MLN

Evidence

• report Report tokensniffer.com
• transaction 1Million contract creation transaction bscscan.com
• address 1Million (MLN) verified contract code on BscScan bscscan.com
• analysis Sourcify match for 0x8034aa1ebb42a4e2110e91666497198e977c8d81 on BNB Chain repo.sourcify.dev