Mommy Milkers Honeypot
What happened
Mommy Milkers (MILKERS) is an Ethereum token deployed on 22 May 2021 at 0x45dac6c8…410c3a. Its transfer check, a modifier named burnTokenCheck, lets the owner, one hidden _safeOwner address and whitelisted wallets move tokens freely, while every other holder's transfer reverts with a fake "transfer amount exceeds balance" error unless it goes to the Uniswap V2 router address. Uniswap sells send tokens to the pair, not the router, so ordinary holders can buy but cannot sell.
Its _mint function also fakes where new tokens go: the Transfer event names one address while the balance is credited to the owner, and the constructor uses this to show mints to three outside wallets whose balances those mints never credit. Etherscan labels the token as reported to be a honeypot with an unsafe reputation, and De.Fi's REKT database lists it as an exit scam and honeypot, describing it as a contract where the owner could stop holders from selling.
How it happened
- The constructor sets
_owner = owner;and_safeOwner = owner;, then calls_mintfive times for 0xAb5801a7…9aeC9B, 0x1Db3439a…Fa6EE6 and (three times) 0xd8dA6BF2…A96045._mintemitsTransfer(address(0), account, amount)but runs_balances[_owner] = _balances[_owner].add(amount);, so the tokens land with the owner while explorers show those wallets receiving them. - The owner's first outgoing transfer, while both slots are equal, moves
_safeOwnerto the recipient:if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. If that first transfer is the liquidity deposit, the Uniswap pair becomes_safeOwner, and transfers out of the pair (buys) always pass. - Other senders that are not whitelisted hit
require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance");._unirouteris hard-coded to 0x7a250d56…F2488D, but a Uniswap V2 sell moves tokens from the holder to the pair, so it reverts with a misleading message. - The only other path,
if (amount < _sellAmount), starts closed because_sellAmountis 0. The owner can open it by sending tokens to itself (_sellAmount = amount;), and a holder who then sells to_safeOwneris blacklisted:if(recipient == _safeOwner){_blackAddress[sender] = true; _whiteAddress[sender] = false;}. - The owner controls the lists and supply:
increaseAllowance(address[])whitelists,addApprove(address[])blacklists,decreaseAllowance(address)sets_safeOwner, and_mintstays callable by the owner after deployment.multiTransferwhitelists chosen recipients and sets an unlimited router allowance on their behalf. There is no function to renounce or change_owner.
Protocol details
Evidence
- report Token Sniffer post (De.Fi proof link) twitter.com
- transaction Mommy Milkers contract creation transaction etherscan.io
- address Mommy Milkers (MILKERS) verified contract code on Etherscan etherscan.io
- analysis Sourcify match for 0x45dac6c8776e5eb1548d3cdcf0c5f6959e410c3a on Ethereum repo.sourcify.dev
- analysis Mommy Milkers (MILKERS) token page on Etherscan etherscan.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.