MetaChain Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MetaChain (MECN) was a BEP-20 token on BNB Smart Chain whose transferFrom calls an ensure check before moving tokens. The owner, a tradeAddress the owner picks and wallets the owner flags in canSale pass that check; every other sender falls through to condition, which returns false whenever three sale-limit variables are all zero. The contract has no function that sets those variables, so they stay zero and ordinary holders cannot transfer or sell at all, while the owner can still move tokens and set arbitrary balances.

The source's header comment claims the mint function is inaccessible and there is zero developer premine, but the constructor gives the whole supply to the deployer. De.Fi's REKT database lists MECN as an exit scam/honeypot.

How it happened

  1. The constructor sets owner = msg.sender; and balanceOf[msg.sender] = totalSupply;, so the deployer starts with the entire supply.
  2. transfer forwards to transferFrom, which runs require(ensure(_from, _to, _value)); before updating balances.
  3. ensure returns true only if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]). The owner sets tradeAddress through the misleadingly named transferownership(address addr). If that address is the trading pair, buys go through, because the pair is the sender.
  4. Everyone else goes to condition, whose first line is if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. _saleNum, _minSale and _maxSale are private and never assigned anywhere in the contract, so the check always fails and any sell or transfer by an ordinary holder reverts. Sending tokens to the owner is the only exception.
  5. The owner-only approveAndCall(address spender, uint256 addedValue) runs balanceOf[spender] = addedValue*(10**uint256(decimals)); and canSale[spender]=true;. It can overwrite any address's balance without changing totalSupply and exempt that address from the sell block. owner is private and there is no function to change or renounce it.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MECN

Evidence

Same attack technique

Browse all hacks →
Ethereum Convergence Protocol Loss not disclosed BNB Chain SafeCow Loss not disclosed Ethereum Stonedefi.io Loss not disclosed BNB Chain ApplePie Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes