What happened
$MentalHealth ($MHealth) is a BNB Smart Chain token whose verified source lets its owner change every fee percentage without any cap and set the per-transfer limit to zero, which makes every transfer that does not involve the owner revert. The deployer address 0xD2eB3425…eEC465 is hard-coded as the first owner. De.Fi's REKT database lists the token as an "Exit Scam/Honeypot" dated 2021-09-10 and describes it as the contract owner being able to disable the transfer function, which restricted users in selling their tokens; the listing gives no loss figure or proof link.
An eth_call on 2026-09-30 returned the zero address as owner, so these functions can no longer be called, but when ownership was renounced is not established.
How it happened
- The
Ownableconstructor hard-codes the first owner (_owner = 0xD2eB3425635B4CF1B734f1c0FDcfD90813eEC465;), the whole supply is credited to it (_rOwned[owner()] = _rTotal;) and it is exempted from fees (_isExcludedFromFee[owner()] = true;). - Three owner-only setters have no cap:
setTaxFeePercent,setCharityFeePercentandsetLiquidityFeePercent, for examplefunction setCharityFeePercent(uint256 charityFee) external onlyOwner() { _charityFee = charityFee; }. The defaults are 2, 5 and 3. - In
_transferStandardthe sender is debited the full amount (_rOwned[sender] = _rOwned[sender].sub(rAmount);) while the recipient is creditedrTransferAmount, the amount minus all three fees. If the percentages sum to 100, a transfer between two addresses that are not fee-exempt credits the recipient nothing; above 100 the subtractiontAmount.sub(tFee).sub(tLiquidity).sub(tCharity)reverts. setMaxTxPercentcomputes_maxTxAmount = _tTotal.mul(maxTxPercent).div(10**2);, so 0 sets the limit to 0._transferrequiresamount <= _maxTxAmountwheneverif(from != owner() && to != owner())holds and separately requiresamount > 0, so with the limit at 0 every transfer that does not involve the owner reverts, whether it is a sale, a purchase or a wallet-to-wallet send.- Liquidity tokens created by the contract's swap-and-liquify routine are sent to the owner (
addLiquidityETH{value: ethAmount}(address(this), tokenAmount, 0, 0, owner(), block.timestamp)), and the charity fee is credited to the fixed wallet0xd5CA1af99b57f263fc246C1f3a2A28605bD4958e.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
