MarsHistory Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MarsHistory is a BNB Smart Chain token whose transfer and transferFrom functions refuse any transfer to the address stored in a variable called newun. transferFrom fills newun automatically with the recipient of the first call made while it is empty, and the owner can also overwrite it with transfernewun. If the first recipient is the liquidity pool, as the blog post describes for this pattern, every later sale through a router, which calls transferFrom with the pool as recipient, reverts with "please wait".

De.Fi's REKT database lists the token as an exit scam/honeypot where the owner could disable the transfer function, which restricted users from selling.

How it happened

  1. newun starts as the zero address. transferFrom runs if(from != address(0) && newun == address(0)) newun = to;, so the first call with a non-zero from stores its recipient as newun and is not blocked.
  2. A liquidity addition through a router moves tokens into the pool with transferFrom, so in that flow the pool address is what gets stored. The code does not name the pool; this step follows the cited blog post and was not checked on chain.
  3. From then on transferFrom takes the else require(to != newun, "please wait"); branch, and transfer runs require(to != newun, "please wait");. No sender is exempt, the owner included.
  4. A holder selling through a router has the router call transferFrom(holder, pool, amount). With newun equal to the pool this reverts before balances[from] is debited, so the sale cannot complete. Buying is unaffected by these lines because tokens leave the pool, and the check only tests the recipient.
  5. transfernewun(address _newun) public onlyOwner lets the owner replace newun with any address. Pointing it at an unused address lifts the block; setting it to the zero address re-arms capture on the next transferFrom whose from is non-zero. No renounce function exists, only transferOwnership and acceptOwnership.
  6. The code shows what the contract permits. It does not show whether sales actually failed, when newun was set or changed, or how much value holders lost.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MarsHistory

Evidence

Same attack technique

Browse all hacks →
BNB Chain SafeLuxury Loss not disclosed BNB Chain DATAMOON Loss not disclosed BNB Chain Deflagration Loss not disclosed BNB Chain ROCKETSHOT Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes