What happened
Moon Fox Community (MFOX) is an Ethereum token whose transfer and transferFrom functions revert for any recipient equal to a stored address called newun. transferFrom fills newun with the recipient of the first transferFrom it processes while newun is empty, and the owner can overwrite it with transfernewun. Whichever address newun holds can no longer receive tokens, so a sell that sends tokens to that address fails with the message please wait.
De.Fi's REKT database lists MFOX as an exit scam / honeypot in which the owner could disable the transfer function and restrict users from selling.
How it happened
- The constructor gives the whole supply to the deployer:
balances[owner] = _totalSupply;.newunstarts as the zero address. transferFromcontains the capture lineif(from != address(0) && newun == address(0)) newun = to;. The first transferFrom that succeeds whilenewunis empty, which is how a router moves tokens when liquidity is added, stores that call's recipient innewun. The code does not name who that recipient is.- From then on every later call hits a block:
transferstarts withrequire(to != newun, "please wait");andtransferFromrunselse require(to != newun, "please wait");. A holder's sale that sends tokens to thenewunaddress reverts, while sends to other addresses go through. - The owner can move the block with
function transfernewun(address _newun) public onlyOwner. Setting it to the zero address lets the next transferFrom capture a new recipient, while pointing it at an unused address lifts the block.
The code allows this; the sources opened for this entry do not include a transaction showing which address newun held or any owner call to transfernewun.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
