FairMoonElon Honeypot

What happened

FairMoonElon (FairMoonElon, contract 0xc796eb5b…3502f0 on BNB Smart Chain) stores a newun address and rejects every transfer whose recipient equals it. The first transferFrom call sets newun to its recipient, so if that call is the liquidity deposit, newun becomes the trading pair and any later sale into the pair reverts with "please wait", while buys still work. The owner can also overwrite newun at any time with transfernewun.

De.Fi's REKT database lists FairMoonElon as an Exit Scam/Honeypot on 2021-04-12 and describes the owner as able to disable transfers so users could not sell.

How it happened

1. The token is deployed with the full supply credited to the deployer: balances[owner] = _totalSupply;.
2. transferFrom runs if(from != address(0) && newun == address(0)) newun = to;. The first call with a non-zero from therefore stores its recipient in newun and skips the check. If that call is the router moving tokens into the pool when liquidity is added, newun is the pair.
3. Every later transferFrom takes the else require(to != newun, "please wait"); branch. A router sale, which calls transferFrom(holder, pair, amount), reverts as long as the pair is newun. transfer carries the same require(to != newun, "please wait");.
4. Buying is unaffected: the pair sends tokens to the buyer with transfer, and the buyer is not newun. Holders can acquire the token but the sell path is closed.
5. The owner can change the block at will with function transfernewun(address _newun) public onlyOwner. Pointing it at an unused address lifts the block for everyone; setting it to zero lets the next transferFrom capture a new recipient. This contract version has no function that gives up ownership.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract FairMoonElon

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing for FairMoonElon twitter.com
• address FairMoonElon verified source on BscScan bscscan.com
• analysis Sourcify repository entry for FairMoonElon repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io