What happened
MaxGoatToken (MGOAT) is a BNB Smart Chain token whose code keeps a single address, newun, and rejects every transfer sent to it with the message "please wait". newun is filled in by the first transferFrom call made while it is empty, or set directly by the owner through transfernewun. If newun ends up being the liquidity pair, which is what an independent write-up of this code pattern describes happening at the first add-liquidity transaction, selling into the pool reverts while buying keeps working.
De.Fi's REKT database lists the token as an exit scam/honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. No transaction or holder data was opened for this token, so the code shows what the owner could do, not what was done.
How it happened
- The constructor mints the whole supply to the deployer, who is also the
owner:balances[owner] = _totalSupply;with_totalSupply = 1000000000000000 * 10**9;and 9 decimals. - The contract stores a blocked address,
address public newun;. The owner can change it at any time withfunction transfernewun(address _newun) public onlyOwner { newun = _newun; }. transferrefuses any recipient equal to it:require(to != newun, "please wait");.transferFrom, the call a router makes when it pulls a seller's tokens into a pool, setsnewunif it is still empty and otherwise applies the same block:if(from != address(0) && newun == address(0)) newun = to;thenelse require(to != newun, "please wait");. The firsttransferFromtherefore picks the blocked address, and the code does not check whofromortois.- If
newunis the pair, a holder's sell reverts at thatrequirebefore any balance is changed, while a buy, where the pair sends tokens to the buyer withtransfer, only fails if the buyer isnewun. The page this record cites as a write-up of the pattern describesnewunbeing set to the pair during the first add-liquidity transaction. - The block can be lifted or re-armed by the owner: pointing
newunat an unused address stops blocking the pair, whiletransfernewun(address(0))lets the nexttransferFromoverwrite it with that call's recipient.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
