What happened
GoldMoon is a BEP20 token on BNB Smart Chain, deployed at 0xd3eb6a8a…105e22 in transaction 0x416c6c8a…1bc10c on 2021-04-14. Its transfer and transferFrom revert with "please wait" whenever the recipient equals a stored address called newun, and the first transferFrom made while newun is empty records that call's recipient as newun. If that first call is the router moving tokens into the trading pair when liquidity is added, the pair becomes the one address nobody can send tokens to, and a DEX sell is exactly a transfer to the pair.
The owner can also reassign newun at any time with transfernewun. De.Fi's REKT database lists GoldMoon as an Exit Scam/Honeypot.
How it happened
- The constructor gives the whole supply, 1000000000000000000000000000000000 raw units (10^15 tokens at 18 decimals), to the deployer:
balances[owner] = _totalSupply;. - While
newunis the zero address, the firsttransferFromcall with a non-zerofromstores its recipient:if(from != address(0) && newun == address(0)) newun = to;. That transfer goes through. If it is the router pulling tokens into the pair during the liquidity add,newunbecomes the pair address; the code does not say which call comes first, and no transaction was opened for this token. - From then on, both entry points reject any transfer into
newun:else require(to != newun, "please wait");intransferFromandrequire(to != newun, "please wait");intransfer. A holder's sell through a router istransferFrom(holder, pair, amount), so it reverts, and the holder's balance is not debited. - The check only looks at the recipient. A pair sending tokens out to a buyer is a transfer to an address other than
newun, so purchases are not stopped by this line. - The owner controls the switch:
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it back to the zero address lets the nexttransferFromcapture a new recipient. Nothing in the source limits how often or when this can be changed.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
