Mia Khalifa Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Mia Khalifa (MiaKhalifa) is a BEP-20 token on BNB Chain at 0xb51d7056…1e3f43, deployed on 13 May 2021 by 0xea173029…685D35, which received the full 100,000,000-token supply and is still the on-chain owner. De.Fi's REKT database lists it as an exit scam/honeypot; the source header is a buying guide copied from another token, still telling readers they are about to purchase "SpaceX Doge". The code has no general on/off switch for transfer.

Instead, the first transferFrom call, normally the router adding liquidity, saves its destination (the PancakeSwap pair) in newun, and every later transfer to that address reverts with "please wait". Holders can buy from the pool but cannot sell into it, and the owner can repoint newun at any time with transfernewun.

How it happened

  1. The constructor credits the whole supply to the deployer: balances[owner] = _totalSupply;.
  2. When liquidity is added, the router pulls tokens with transferFrom. Because newun is still empty, if(from != address(0) && newun == address(0)) newun = to; stores the destination, which is the PancakeSwap pair.
  3. Buyers receive tokens from the pair through transfer, which only rejects transfers whose destination is newun, so buys succeed.
  4. Selling means sending tokens to the pair. transfer checks require(to != newun, "please wait"); and transferFrom runs else require(to != newun, "please wait");, so every sell reverts.
  5. The owner can change the blocked address with function transfernewun(address _newun) public onlyOwner, which can unblock the pair for chosen moments or block another address.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MiaKhalifa

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.