MarsStop Honeypot

What happened

De.Fi's REKT database lists MarsStop (MARSSTOP) as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source at 0x2c8ef110…947e6a on BNB Smart Chain contains the pattern the listed blog post calls a stealthy LP block: transferFrom records the recipient of the first transfer in a variable called newun, then refuses every later transfer to that address with the message "please wait". The owner can also overwrite newun at any time.

How it happened

1. The contract stores an address newun, empty at deployment. The constructor mints the whole supply to the deployer: balances[owner] = _totalSupply; (_totalSupply = 10000000000000000000000000000, 10,000,000,000 tokens at 18 decimals).
2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom that succeeds therefore sets newun to its recipient, and from then on every transferFrom whose recipient is that address reverts. The cryptot3ddybear blog post describing this pattern says newun ends up as the DEX liquidity pair when liquidity is added, so sells (which send tokens to the pair) are refused while buys, which come out of the pair, are not. For this token the pair address stored in newun was not read from the chain in this draft.
3. Direct transfers are blocked to the same address: transfer starts with require(to != newun, "please wait");. While newun is still unset (the zero address) this also rejects sending to the zero address.
4. The owner can change the target: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to address(0) lets the next transferFrom capture a new recipient; pointing it at an unused address lifts the block on the pair.
5. clearCNDAO() lets the owner withdraw any BNB balance held by the contract: _owner.transfer(address(this).balance);.
6. What happened is limited to the listing and the blog: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. No transaction, loss figure or liquidity record was opened for this token, so the code shows how sells could be blocked, not that they were.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MARSSTOP

Evidence

• report @Token_Sniffer incident report twitter.com
• report De.Fi REKT database listing for MARSSTOP (proof: Token Sniffer post) twitter.com
• address MARSSTOP verified source on BscScan bscscan.com
• analysis Sourcify match for 0x2c8ef110073b556992942fdc017a54a38f947e6a repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear) cryptot3ddybear.gitlab.io