Monkey Island Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Monkey Island (MONKEY) is an Ethereum token with an address variable newun that, once set, makes every transfer to that address revert with "please wait". The first transferFrom call made while newun is empty stores its recipient there, which is how a liquidity deposit would mark the pool, and the owner can also set it directly with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot dated 2021-04-24, saying the owner could disable the transfer function, which restricted users in selling their tokens.

The listing gives no loss amount, and the code alone does not show which address newun held or whether any holder was blocked.

How it happened

  1. newun is a public address that starts as zero; transfernewun(address _newun) lets the owner overwrite it with any address, including zero.
  2. In transferFrom, the first line is if(from != address(0) && newun == address(0)) newun = to;. The first transferFrom made while newun is zero therefore stores that call's recipient in newun and does not revert. If that call is a liquidity deposit, newun becomes the pool address. The code does not show who to was.
  3. After that, transferFrom takes the else require(to != newun, "please wait"); branch and transfer runs require(to != newun, "please wait");. Any transfer into the stored address reverts for every caller, so a sell through a router (transferFrom into the pool) fails and the holder's balance is not debited. Tokens leaving that address, such as a buyer's purchase, hit no such check.
  4. The block can be lifted or re-armed by the owner: transfernewun pointed at an unused address ends it, while setting it to zero re-arms capture, so the next transferFrom stores a new recipient. Nothing in the contract changes owner except the transferOwnership/acceptOwnership pair.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MONKEY

Evidence

Same attack technique

Browse all hacks →
Ethereum German Shepherd Loss not disclosed Ethereum UnoRe Loss not disclosed Ethereum Safe Sex Loss not disclosed BNB Chain Atmosphere Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes