Malamute Token Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Malamute Token (MLM) is an Ethereum token deployed on 21 April 2021 at 0xb913c80b…75d174. The first transferFrom call the contract ever processes stores its recipient in a hidden variable, newun; when liquidity is added through a DEX router, that recipient is the liquidity pool. From then on, both transfer and transferFrom revert with "please wait" for any transfer to newun, so holders cannot sell into the pool, while purchases, which move tokens out of the pool, still succeed.

The owner can change newun at any time with transfernewun. De.Fi's REKT database lists Malamute Token as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor mints the whole supply of 1,000,000,000,000 MLM to the owner, and newun starts as the zero address.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; saves the recipient of the first transferFrom as newun. Adding liquidity through a router moves the owner's tokens to the pair with transferFrom, which would make the pair newun.
  3. Every later transferFrom runs require(to != newun, "please wait"), and transfer runs the same check, so a router sale or a direct send to the pair reverts.
  4. Buys use the pair's transfer to the buyer, whose recipient is not newun, so buying keeps working.
  5. transfernewun(address) is onlyOwner, so the owner can move the block to another address or reset it. The contract has no renounceOwnership; ownership only changes through transferOwnership and acceptOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MLM

Evidence

Same attack technique

Browse all hacks →
Ethereum Treasure Box Loss not disclosed BNB Chain CUMROCKET CRYPTO Loss not disclosed Ethereum MOAR Finance Loss not disclosed Ethereum Golden Inu Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes