MONKEY Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MONKEY is a BEP-20 token on BNB Chain built from a known PancakeSwap "liquidity pool block" template. The first transferFrom call, which normally happens when liquidity is added through the PancakeSwap router, silently stores the recipient (the new pair) in a variable named newun. From then on every transfer or transferFrom whose recipient is newun reverts with please wait, so holders can buy from the pool but cannot sell into it.

The owner, a hard-coded address, can also change newun at any time through transfernewun. De.Fi's REKT database lists MONKEY as an exit scam/honeypot; no transaction evidence of losses was found.

How it happened

  1. The constructor credits the full supply to the hard-coded owner address 0xc55847BF…f98272.
  2. When liquidity is first added, the router calls transferFrom(owner, pair, ...); because newun is still empty, the line if(from != address(0) && newun == address(0)) newun = to; records the pair address and lets that transfer through.
  3. Buyers receive tokens from the pair through transfer, which only checks that the recipient is not newun, so buys succeed.
  4. A sale requires moving tokens to the pair, so require(to != newun, "please wait") reverts every sell, whether sent through transfer or the router's transferFrom.
  5. Nothing in the token restricts tokens leaving the pair, so the code does not stop the liquidity provider from withdrawing the pool's liquidity while holders are unable to sell.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MONKEY

Evidence

Same attack technique

Browse all hacks →
BNB Chain Shiba Diamond Loss not disclosed Ethereum Kyushu Inu Loss not disclosed BNB Chain ArgonNetwork Loss not disclosed Ethereum Misa Inu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes