MEGAMOON Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists MEGAMOON on BNB Smart Chain as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function, which restricted users in selling their tokens. In the verified source, transferFrom stores the recipient of its first call in a variable named newun. After that, every transfer or transferFrom whose recipient is newun reverts with the message "please wait", and the owner can overwrite newun at any time through transfernewun.

The code does not show which address newun captured.

How it happened

  1. The constructor mints the whole supply to the deployer (balances[owner] = _totalSupply;). newun starts as the zero address.
  2. The first transferFrom where from is not the zero address runs if(from != address(0) && newun == address(0)) newun = to;, so the recipient of that call is stored as newun and the transfer itself goes through. A write-up of the same code pattern on other tokens describes this first call as the liquidity add, which makes newun the pool address; the MEGAMOON code alone does not show who the recipient was.
  3. Every later transferFrom takes the other branch, else require(to != newun, "please wait");, and transfer starts with require(to != newun, "please wait");. A transfer into newun reverts, so nothing is debited from the sender's balance and the tokens cannot reach that address. Neither function exempts the owner.
  4. The owner controls the block through function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing newun at an address that is never used lifts the block; pointing it at a chosen address blocks that address; setting it to the zero address re-arms the capture, so the recipient of the next transferFrom becomes newun.
  5. What the code allows is separate from what happened. De.Fi's REKT database lists the token as an Exit Scam/Honeypot; the proof link it gives could not be opened here, so no transaction showing the block in use or the owner changing newun was checked.

Protocol details

Classification Token
Protocol Type Luck Games
Affected asset / contract MEGAMOON
Protocol links Website @0xMegaMoon

Evidence

Same attack technique

Browse all hacks →
Ethereum Jigstack.org Loss not disclosed BNB Chain MoonDog Loss not disclosed BNB Chain Private Token Offering Loss not disclosed BNB Chain MoonSafebank Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes