DogeMother Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

DogeMother (MDOG) is a BEP-20 token on BNB Chain, deployed from 0xF2a0d903…1604FB in transaction 0x492927b4…e3c933. De.Fi's REKT database lists it as an Exit Scam/Honeypot: the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows how: a stored address, newun, that cannot receive tokens through transfer or transferFrom, and which the owner can overwrite at any time.

The code allows this block; the listing gives no loss figure.

How it happened

  1. The contract stores a public address newun and reverts any move of tokens to it: require(to != newun, "please wait"); in transfer, and else require(to != newun, "please wait"); in transferFrom.
  2. newun is not set in the constructor. The first transferFrom call where it is still empty runs if(from != address(0) && newun == address(0)) newun = to;, which stores that call's recipient as newun and lets the transfer go through. A blog post analysing this code pattern describes the first liquidity addition as the call that captures the pool address; this contract's code does not name the pool, so which address was captured is not shown by the source alone.
  3. From then on, any transferFrom whose to equals newun fails with "please wait". A swap that sells tokens pulls them with transferFrom into the pool, so if the pool is the stored address, sells revert while buys (tokens leaving the pool) still work.
  4. The owner can also change the block by hand: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to zero lets the next transferFrom capture a new recipient; pointing it at an unused address lifts the block.
  5. clearCNDAO() is onlyOwner and sends address(this).balance, the native coin held by the token contract, to the owner. It does not touch liquidity-pool funds. The contract has no renounceOwnership; ownership moves only through the two-step transferOwnership and acceptOwnership.
  6. Whether liquidity was withdrawn or how many holders were unable to sell is not shown by the code or by the sources opened; De.Fi's REKT database lists the token as an Exit Scam/Honeypot without a loss figure.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MDOG

Evidence

Same attack technique

Browse all hacks →
Ethereum Da Vinci Coin Loss not disclosed Ethereum Counter Strike Community Loss not disclosed BNB Chain Larafinance Loss not disclosed BNB Chain NeutrinoProtocol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes