MOON WEED Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MOON WEED (MOONWEED) is a BEP-20 token on BNB Smart Chain at 0xc3950f1d…9be09b, deployed on 14 April 2021 with 1,000,000,000,000 tokens minted to the deployer. It uses the "stealthy liquidity pool block" template: the first transferFrom call, normally the router moving the deployer's tokens into the PancakeSwap pair when liquidity is added, silently stores the recipient in a variable named newun. After that, both transfer and transferFrom revert with "please wait" whenever the recipient is newun, so buyers can receive MOONWEED from the pair but cannot send it back to sell.

The owner can also repoint newun to any address with transfernewun, and the contract has no renounce function. De.Fi's REKT database lists MOONWEED as an exit scam/honeypot, citing a write-up that describes this template in other tokens.

How it happened

  1. The constructor sets symbol = "MOONWEED", name = "MOON WEED" and credits the full _totalSupply of 1,000,000,000,000 tokens (9 decimals) to the owner, the deployer.
  2. transferFrom starts with if(from != address(0) && newun == address(0)) newun = to;. The first call anyone makes records its recipient as newun and completes normally. When the deployer adds liquidity, the router's transferFrom(deployer, pair, amount) makes the PancakeSwap pair newun.
  3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer checks require(to != newun, "please wait"); on every call.
  4. A buy sends MOONWEED from the pair to the buyer, so it passes. A sell sends MOONWEED to the pair, through the router's transferFrom or a direct transfer, and reverts.
  5. transfernewun(address _newun) is onlyOwner, so the owner can move the block to any address or clear it. Owned has no renounceOwnership; ownership can only pass to a newOwner that calls acceptOwnership.
  6. clearCNDAO() lets the owner withdraw any BNB held by the token contract.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MOONWEED

Evidence

Same attack technique

Browse all hacks →
BNB Chain Strike Protocol Loss not disclosed BNB Chain SafeCookie Loss not disclosed BNB Chain Bulldoge Loss not disclosed BNB Chain KingCZ Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes