MoonChain Honeypot

What happened

MoonChain (MCF) is a BNB Smart Chain BEP-20 token with an owner-controlled tracing flag. When the owner turns it on, transferFrom and transfer start rejecting transfers to a single recorded address nxOwner, which is set automatically from the first transferFrom recipient while tracing is on. De.Fi's REKT database lists the token as an exit scam/honeypot and states that the owner could disable the transfer function, which restricted users in selling their tokens.

The code allows that outcome. Whoever is recorded as nxOwner also passes the onlyOwner check, and the owner can add to its own balance with emitTransfer.

How it happened

1. The constructor sets symbol = "MCF"; name = "MoonChain"; decimals = 9;, credits _totalSupply = 860000000000000000 to the deployer, and moves half of it to the dead address.
2. The owner (or nxOwner) can toggle the flag: function setTracing(bool _tracing) onlyOwner public { tracing = _tracing; }. tracing starts as false.
3. With tracing on, transferFrom runs the modifier contextHandler(from, to): if(from != address(0) && nxOwner == address(0)) nxOwner = to; else require(to != nxOwner, "Order ContextHandler");. The first transferFrom made while the flag is on succeeds, from any caller, and records its recipient as nxOwner. The owner does not choose that address through any function. Every later transferFrom to it reverts. The source does not say who that first recipient is.
4. transfer uses requestHandler(to): if(tracing) require(to != nxOwner, "Handling Request");, so direct transfers to nxOwner also revert while the flag is on. If nxOwner is a liquidity pair, holders cannot sell into it.
5. onlyOwner is require(msg.sender == owner || msg.sender == nxOwner);, so whoever is recorded as nxOwner also gains the owner functions. These include emitTransfer(uint256 _input), which executes balances[msg.sender] = balances[msg.sender] + (_input); without changing _totalSupply, and _construct(), which sends the contract's BNB balance to the caller.
6. renounceOwnership(address _newOwner) has no access check and only writes currentOwner = _newOwner. It does not change owner, so it removes no power.
7. The source does not show that the owner enabled tracing or used emitTransfer. De.Fi's REKT database lists the token as a honeypot dated 2021-05-18.

Protocol details

Classification Token

Protocol Type Chain

Affected asset / contract MCF

Protocol links Website @Moonchain_com

Evidence

• report De.Fi REKT database entry for MCF (proof link: Token Sniffer X post, generic, no token named) twitter.com
• address BscScan verified source, MoonChain (MCF) bscscan.com
• analysis Sourcify repository, chain 56 repo.sourcify.dev