MoonExpress Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonExpress (MEXPRESS) is a BNB Chain token deployed on 28 March 2021 at 0xf6146f62…9e8c08. Every transfer and transferFrom runs through a modifier, burnTokenCheck, that lets the owner, an owner-chosen _safeOwner address and whitelisted wallets move tokens freely, but makes any other holder's transfer revert unless it goes to a hard-coded router address or is smaller than an owner-set _sellAmount, which starts at zero. A PancakeSwap sale moves tokens from the holder to the pair rather than to the router, so it fails with a misleading "transfer amount exceeds balance" error, and a holder whose small sale does reach _safeOwner is added to a blacklist.

The owner manages the whitelist and blacklist through functions misleadingly named increaseAllowance and addApprove, and a public owner-only _mint can add tokens to the owner's balance. De.Fi's REKT database lists MoonExpress as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling their tokens.

How it happened

  1. The constructor stores the owner argument as both _owner and _safeOwner and mints the initial supply to it. Because _mint requires msg.sender == _owner, the owner has to be the deployer, 0x8Cbe0411…AF35aD.
  2. The owner's first outgoing transfer makes its recipient the new _safeOwner. If that first transfer is the liquidity deposit, the PancakeSwap pair becomes _safeOwner.
  3. Transfers sent by the owner or by _safeOwner, or sent to the owner, always pass, so purchases paid out by a pair that is _safeOwner go through.
  4. For every other sender, a whitelisted wallet passes. A blacklisted wallet, or any wallet moving at least _sellAmount, must satisfy (sender == _safeOwner)||(recipient == _unirouter). A router sale sends tokens to the pair, not to _unirouter, so it reverts. _sellAmount stays 0 until the owner sends tokens to itself, so by default no ordinary holder can sell any amount.
  5. If the owner raises _sellAmount, a holder can move a smaller amount, but a transfer to _safeOwner flags the sender as blacklisted, so that holder's next sale reverts.
  6. Owner-only increaseAllowance(address[]) whitelists wallets, addApprove(address[]) blacklists them, decreaseAllowance(address) replaces _safeOwner, and multiTransfer sends tokens and whitelists the first approvecount recipients. No function changes or renounces _owner.
  7. _mint(address, uint256) is public and owner-only. It adds the amount to _balances[_owner] whatever address is passed, while the Transfer event names that address.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MEXPRESS

Evidence

Same attack technique

Browse all hacks →
BNB Chain ElonTrade 100x Loss not disclosed BNB Chain LIGHT LUNAR PROTOCOL Loss not disclosed BNB Chain SafeFLM Loss not disclosed BNB Chain ELONFLY Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes