What happened
MOON FARM (symbol MoonFarm) is a BEP-20 token on BNB Chain whose transfer functions refuse any transfer into one stored address, newun. The first transferFrom call fills newun with its recipient, and for a new token that call is normally the router moving tokens into the PancakeSwap pair when liquidity is added. From then on, buying works because the pair sends tokens out with transfer, but selling means sending tokens to the pair, and both transfer and transferFrom revert with "please wait".
The deployer, who received the whole 21,000-token supply, can re-point newun at any time with transfernewun. De.Fi's REKT database lists MOON FARM as a honeypot, and an April 2021 write-up describes the same code in other BNB Chain tokens.
How it happened
- The constructor makes the deployer the owner and credits it with the full supply of 21,000 tokens (18 decimals).
newunstarts as the zero address. The firsttransferFromfrom a non-zero sender stores its recipient innewunwithout any check, so if that call is the liquidity add, the pair becomes the blocked address.- Every later
transferortransferFromwhose recipient equalsnewunreverts with "please wait". Buyers receive tokens from the pair, but a sell through the router, which callstransferFrominto the pair, fails. - The owner can call
transfernewunto setnewunto any address, which can lift the block or move it elsewhere. The contract has no owner exemption from the block, so the owner would also need to changenewunbefore selling to the pair.
Protocol details
Evidence
- report Token Sniffer post on X (De.Fi proof link) twitter.com
- address MOON FARM verified source code on BscScan bscscan.com
- analysis BSC-SCAM: Stealthy Liquidity Pool Block on PancakeSwap cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x46b11d155713986c4e2f5b72e6644358ad7dbe98 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
