Mercurial Finance Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Mercurial.Finance (MER) is an ERC-20 token on Ethereum whose transfer logic stops ordinary holders from selling by default. Every transfer and transferFrom passes through the burnTokenCheck modifier: the owner, the _safeOwner address and owner-whitelisted wallets can move tokens freely, while any other holder is rejected unless the recipient is the hard-coded Uniswap V2 router address. A Uniswap sale sends tokens to the pair, not the router, so it reverts with a fake ERC20: transfer amount exceeds balance error.

The owner controls whitelist, blacklist and _safeOwner setters disguised as increaseAllowance, addApprove and decreaseAllowance, and a public _mint that credits unlimited tokens to the owner. De.Fi's REKT database lists the token as an exit scam/honeypot; no loss figure or transaction evidence was found.

How it happened

  1. The constructor sets both _owner and _safeOwner to the owner address passed at deployment and mints the supply (1,000,000,000 MER on-chain) to it.
  2. The first transfer the owner makes while _owner == _safeOwner reassigns _safeOwner = recipient, giving that recipient unrestricted sending rights. The owner can also set _safeOwner directly with decreaseAllowance(address).
  3. _sellAmount starts at 0, so for a holder who is neither whitelisted nor blacklisted the check amount < _sellAmount is false and the transfer only succeeds if sender == _safeOwner or recipient == _unirouter.
  4. Selling through Uniswap moves the holder's tokens to the pair contract, so neither condition holds and the sale reverts with a message that imitates an insufficient balance.
  5. The owner can open a narrow window by transferring to itself, which sets _sellAmount; a holder who then sends a smaller amount to _safeOwner is automatically moved onto the blacklist.
  6. multiTransfer lets the owner send tokens to a list of wallets, whitelist the first approvecount of them and give each a maximum allowance for the Uniswap router, so those chosen wallets can sell while other buyers cannot.
  7. The owner can whitelist or blacklist any address, and can call the public _mint, which adds any amount to the owner's balance while the Transfer event names whatever account the caller passes.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MER

Evidence

Same attack technique

Browse all hacks →
BNB Chain TheMountain Loss not disclosed BNB Chain DeFiner Loss not disclosed Ethereum Skem.finance Loss not disclosed Ethereum Falcon 9 SpaceX Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes