MoonDegenerates Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonDegenerates (MDegen) is a BNB Smart Chain token whose _transfer reverts for most senders while an owner-controlled flag, TIME, is true. The flag starts as true, and only the owner can switch it with setTIME. The revert text talks about one sale per 30 minutes, but the time comparison is commented out in the source, so no timer exists.

A holder who is not the owner and not the address stored in pancake is refused when sending to any recipient other than the owner, including a liquidity pair; sends to the owner are not blocked. De.Fi's REKT database lists the token as an exit scam/honeypot and says the owner could disable the transfer function.

How it happened

  1. The constructor mints the whole supply of 100,000,000,000 tokens (_mint(msg.sender, 100000000000e18)) to the deployer, who is also the Ownable owner, and TIME is declared as bool private TIME = true;.
  2. Whenever the owner is the sender, _transfer stores the recipient in pancake (if(sender == owner()){ pancake = recipient; }). If the owner sends tokens into a liquidity pair, that pair becomes the one address allowed to send. The owner can also set it directly with addPancake.
  3. Other transfers hit if(sender != owner() && recipient != owner() && sender != pancake && TIME == true){ revert("FOR VALUE PROTECTION, YOU CAN ONLY SELL 1 Sale PER 30 MIN"); }. A holder selling through a router sends from their own address to the pair, so the call reverts. Wallet-to-wallet transfers revert the same way. Transfers sent by the owner or by the pancake address, which covers buys from a pair stored there, and transfers whose recipient is the owner are not caught by this check.
  4. The message mentions a 30-minute limit, but the only time-based variable is a commented-out uint256 timeNow = block.timestamp;. The revert fires on TIME == true alone.
  5. The owner can switch the block with setTIME(bool). Four more owner-only controls can also stop sells: fire sets the cap MAX, POOL marks recipients that are checked against MAX, GTYA flags a sender as a bot so require(amount <=0, "bots......") always reverts, and setFee can charge up to 10% (_newTxFee <= 100 over a 1000 divisor).
  6. What the code shows about ownership: renounceOwnership exists, and a read of owner() on 2026-09-30 returned the zero address, so setTIME can no longer be called. That read is the current state only. The supplied files do not show when ownership was renounced or what TIME held at that moment, and no transaction was opened that shows sells failing.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MDegen

Evidence

Same attack technique

Browse all hacks →
BNB Chain GEMROCKET Loss not disclosed BNB Chain HuskyMoon Loss not disclosed BNB Chain ShibaBTC Loss not disclosed Ethereum KISHUSWAP Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes