Mommy Milkers Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Mommy Milkers (MILKERS) is an Ethereum token deployed on 22 May 2021 at 0x45dac6c8…410c3a. Its transfer check, a modifier named burnTokenCheck, lets the owner, one hidden _safeOwner address and whitelisted wallets move tokens freely, while every other holder's transfer reverts with a fake "transfer amount exceeds balance" error unless it goes to the Uniswap V2 router address. Uniswap sells send tokens to the pair, not the router, so ordinary holders can buy but cannot sell.

Its _mint function also fakes where new tokens go: the Transfer event names one address while the balance is credited to the owner, and the constructor uses this to show mints to three outside wallets whose balances those mints never credit. Etherscan labels the token as reported to be a honeypot with an unsafe reputation, and De.Fi's REKT database lists it as an exit scam and honeypot, describing it as a contract where the owner could stop holders from selling.

How it happened

  1. The constructor sets _owner = owner; and _safeOwner = owner;, then calls _mint five times for 0xAb5801a7…9aeC9B, 0x1Db3439a…Fa6EE6 and (three times) 0xd8dA6BF2…A96045. _mint emits Transfer(address(0), account, amount) but runs _balances[_owner] = _balances[_owner].add(amount);, so the tokens land with the owner while explorers show those wallets receiving them.
  2. The owner's first outgoing transfer, while both slots are equal, moves _safeOwner to the recipient: if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. If that first transfer is the liquidity deposit, the Uniswap pair becomes _safeOwner, and transfers out of the pair (buys) always pass.
  3. Other senders that are not whitelisted hit require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance");. _unirouter is hard-coded to 0x7a250d56…F2488D, but a Uniswap V2 sell moves tokens from the holder to the pair, so it reverts with a misleading message.
  4. The only other path, if (amount < _sellAmount), starts closed because _sellAmount is 0. The owner can open it by sending tokens to itself (_sellAmount = amount;), and a holder who then sells to _safeOwner is blacklisted: if(recipient == _safeOwner){_blackAddress[sender] = true; _whiteAddress[sender] = false;}.
  5. The owner controls the lists and supply: increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, decreaseAllowance(address) sets _safeOwner, and _mint stays callable by the owner after deployment. multiTransfer whitelists chosen recipients and sets an unlimited router allowance on their behalf. There is no function to renounce or change _owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MILKERS

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.