Media Network Honeypot

What happened

De.Fi's REKT database lists Media Network (MEDIA) on Ethereum as an Exit Scam/Honeypot and describes the contract owner as able to disable the transfer function, which restricted users from selling. In the verified source for 0x862060f1…28f176, a burnTokenCheck modifier on every transfer lets only the owner, a stored _safeOwner, whitelisted addresses and transfers to the owner pass freely. Other senders can send only to the hard-coded router address 0x7a250d56…F2488D, or in amounts below an owner-set _sellAmount, so a normal holder's sell into a pool reverts with "ERC20: transfer amount exceeds balance".

How it happened

1. The constructor stores the same address as _owner and _safeOwner and mints the supply to it: _owner = owner; _safeOwner = owner; _mint(_owner, initialSupply*(10**18));. _sellAmount starts at 0.
2. transfer and transferFrom both call _approveCheck, which is wrapped in the burnTokenCheck modifier. When _owner == _safeOwner and the sender is the owner, the first branch runs _safeOwner = recipient; and the transfer proceeds, so the owner's first transfer re-points _safeOwner at its recipient. The code does not show which address that was on-chain.
3. Otherwise, a transfer proceeds without further checks if sender == _owner || sender == _safeOwner || recipient == _owner, or if _whiteAddress[sender] == true. If the owner sends tokens to itself, _sellAmount = amount; is set.
4. For every other sender the code requires (sender == _safeOwner)||(recipient == _unirouter), with the failure message "ERC20: transfer amount exceeds balance". That is the case for blacklisted senders and for non-listed senders whose amount is not below _sellAmount. A holder selling through the router sends tokens to the pair rather than to _unirouter, so with _sellAmount at 0 the sell reverts, while a holder's own transfer to the router address passes.
5. If _sellAmount is set above 0, a non-listed sender can move amounts below it; if the recipient is _safeOwner the sender is added to _blackAddress.
6. Owner-only functions control the lists: increaseAllowance(receivers) whitelists and un-blacklists, addApprove(receivers) blacklists and un-whitelists, decreaseAllowance(safeOwner) replaces _safeOwner, and multiTransfer sends tokens and whitelists the first approvecount receivers. These function names do not match what they do. The code does not show which were called.
7. _mint is public but guarded by require(msg.sender == _owner, ...) and adds to _balances[_owner], so the owner can raise the supply; no transaction shown here proves it was used.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MEDIA

Evidence

• report @Token_Sniffer incident report twitter.com
• address Etherscan verified source code, Media Network 0x862060f17151162aa140f19382ef7405f528f176 etherscan.io
• analysis Sourcify repository entry for the same contract repo.sourcify.dev