JUSTMOON Honeypot

What happened

JUSTMOON's transfer and transferFrom both revert with "please wait" when the recipient equals a stored address, newun. In transferFrom, the first call made while newun is unset stores that call's recipient as newun without any check. If that recipient is the liquidity pair, every later sale that sends tokens to the pair reverts, while the owner-only transfernewun can point newun at any address.

De.Fi's REKT database lists JUSTMOON as an exit scam/honeypot on BNB Chain dated 2021-04-07 and describes the owner as able to disable transfers so users could not sell.

How it happened

1. The constructor sets balances[owner] = _totalSupply; with _totalSupply = 1000000000000000000000000 and decimals = 9, so the deployer starts with the whole supply. newun starts as the zero address.
2. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; stores the recipient of the first transferFrom call as newun and lets that transfer through. A router adding liquidity pulls tokens with transferFrom, so if the pair is that first recipient, the pair becomes newun. The source does not itself show which address that was for JUSTMOON.
3. From then on, else require(to != newun, "please wait"); in transferFrom and require(to != newun, "please wait"); in transfer revert any transfer whose recipient is newun. A swap that sells the token sends it to the pair through the router, so that sale reverts.
4. Transfers to other addresses are not affected by these lines, and a transfer out of the pair to a buyer has a recipient other than newun.
5. The owner can call transfernewun(address _newun) (onlyOwner) at any time. Setting it to an unused address lifts the block; setting it to the zero address makes the next transferFrom recipient the new newun. The source has no renounceOwnership, only transferOwnership and acceptOwnership.
6. What the code allows is separate from what happened: the code does not show who added liquidity or removed it. De.Fi's REKT database lists the token as an exit scam/honeypot.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract JUSTMOON

Evidence

• report @Token_Sniffer incident report twitter.com
• report JUSTMOON source on Sourcify repo.sourcify.dev
• address JUSTMOON verified source on BscScan bscscan.com
• analysis Scam Explained: BSC Stealthy LP Block cryptot3ddybear.gitlab.io
• analysis De.Fi REKT database listing for JUSTMOON (as imported in meta.json) de.fi