Floyd Crypto Mayweather Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Floyd Crypto Mayweather (FCM) is an Ethereum token deployed on 25 April 2021 at 0xee6b3f5f…906901 by 0x638e2a92…80beEC, which still owns it and received the whole 100,000,000,000,000,000-token supply. The first transferFrom the contract ever processes stores its destination in newun, and every later transfer to that address reverts with "please wait". When the first transferFrom is the Uniswap liquidity deposit, newun is the pair: buys still work because the pair sends tokens out with transfer, but every sale, which sends tokens into the pair, fails.

The owner can also point newun at any address with transfernewun. This is the pattern cryptot3ddybear described in April 2021 for BNB Chain tokens; Etherscan labels this contract Fake_Phishing224848 after a GoPlusSecurity report, and De.Fi's REKT database lists it as an exit scam/honeypot.

How it happened

  1. The constructor sets owner = msg.sender (0x638e2a92…80beEC) and credits it the full _totalSupply of 10000000000000000000000000 raw units (100,000,000,000,000,000 FCM at 8 decimals).
  2. newun starts as the zero address. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first transferFrom as newun. Adding liquidity through the Uniswap router is a transferFrom from the deployer to the pair, so the pair is recorded if that is the first one.
  3. From then on, both transfer and transferFrom run require(to != newun, "please wait"). The check is on the recipient, so any transfer into the pair reverts, which is every sale; buys, where the pair pays out with transfer to the buyer, still go through.
  4. transfernewun(address _newun) is onlyOwner and can set newun to any address at any time, including the zero address, so the owner controls whether and where the block applies.
  5. Liquidity withdrawal is not blocked: removing liquidity makes the pair send tokens out, not in. clearCNDAO() also lets the owner withdraw any ETH the contract holds. The two-step transferOwnership/acceptOwnership exists, but owner read on-chain is still the deployer.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract FCM

Evidence

Same attack technique

Browse all hacks →
BNB Chain BullsDrop Loss not disclosed BNB Chain Pudgy Token Loss not disclosed BNB Chain SATANS PLAYHOUSE Loss not disclosed BNB Chain SAFEGUARD Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes