MoonBanana Honeypot

What happened

MoonBanana is a BNB Smart Chain token whose transferFrom records the recipient of the first call as newun and from then on reverts any transfer or transferFrom sent to that address with please wait. If that first call was the initial liquidity addition, newun is the liquidity pair, so selling tokens into the pool fails while buying still works. The owner can change newun at any time with transfernewun.

De.Fi's REKT database lists MoonBanana as an Exit Scam/Honeypot dated 2021-04-10 and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor assigns the full supply of 1000000000000000000000000000000000 raw units (10^15 tokens at 18 decimals) to owner, which Owned sets to the deployer.
2. The first transferFrom made while newun is unset skips the check and stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. The code does not show who made that call; in a pool setup the recipient would be the pair that receives the liquidity.
3. From then on every transferFrom runs else require(to != newun, "please wait"); and every transfer runs require(to != newun, "please wait");. Nothing exempts the owner or any other address, so any transfer into newun reverts, including a router sale that pays tokens to a pair stored there.
4. Transfers out of newun and transfers to any other address are unrestricted, so purchases and liquidity removal are not blocked by this code.
5. function transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Setting it to address(0) re-arms the capture for the next transferFrom; pointing it at an address nobody uses lifts the block. There is no timelock or renounce function in the source.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MoonBanana

Evidence

• report @Token_Sniffer incident report twitter.com
• address MoonBanana verified source on BscScan bscscan.com
• analysis Sourcify repository entry for 0xff630b3c5bc433bc0690e3b1aecde42349557e32 repo.sourcify.dev
• analysis Scam explained: BSC stealthy LP block (cryptot3ddybear blog) cryptot3ddybear.gitlab.io