LIGHT LUNAR PROTOCOL Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

LIGHT LUNAR PROTOCOL (LUNAR) is a BNB Smart Chain token whose transfer and transferFrom refuse any transfer to a stored address called newun. The first transferFrom call made while newun is empty stores that call's recipient as newun, which is what a router-based liquidity add produces, and after that no token can be sent to it. If that address is the trading pair, sells fail with "please wait" while buys, which move tokens out of the pair, are not checked.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-03-28 and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor sets symbol = "LUNAR", name = "LIGHT LUNAR PROTOCOL" and mints the full _totalSupply of 3,376,000,000 tokens (18 decimals) to owner, the deployer.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. While newun is empty, the first transferFrom whose from is non-zero stores its recipient in newun and skips any check. A router-based liquidity add calls transferFrom with the pair as to, so the pair would be stored. The code does not name the pair, so this describes how the code behaves, not which address was stored.
  3. Every later transferFrom takes the else branch, else require(to != newun, "please wait");, and transfer has require(to != newun, "please wait");. Any transfer whose recipient is newun reverts.
  4. A holder selling through the router makes the router call transferFrom(holder, pair, tokens). If newun is the pair, to == newun and the sell reverts. A buy sends tokens from the pair to the buyer with to set to the buyer, which passes.
  5. The owner can call transfernewun(address _newun) at any time. Setting it to the zero address lets the next transferFrom capture a new recipient; pointing it at an address that never receives tokens lifts the block. clearCNDAO() also lets the owner send the contract's own BNB balance to themselves; it does not touch token balances.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract LUNAR

Evidence

Same attack technique

Browse all hacks →
BNB Chain KINGOFREFLECT Loss not disclosed BNB Chain ElonTrade 100x Loss not disclosed BNB Chain MoonExpress Loss not disclosed BNB Chain SafeFLM Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes