MoonFEG Token Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists MoonFEG Token (MOONFEG) on BNB Smart Chain as an exit scam/honeypot, noting that the contract owner could disable the transfer function and so restrict users from selling. In the verified source, transfer is unrestricted, but transferFrom, which a DEX router uses to pull a seller's tokens, requires allow[_from] == true. Only the deployer is flagged in the constructor, so ordinary holders cannot sell through a router until a hard-coded privileged address flags them with addAllow.

The source header says liquidity was locked for one year; that is a comment in the code and was not checked against a lock record.

How it happened

  1. The constructor gives the whole supply to the deployer and flags only that address: balances[msg.sender] = totalSupply; and allow[msg.sender] = true;. All other addresses default to allow false.
  2. transfer only checks require(balances[msg.sender] >= _value);, so direct token moves, including a pool sending tokens to a buyer, are not gated.
  3. transferFrom adds require(allow[_from] == true); after the balance and allowance checks. A router sell pulls the tokens from the holder with transferFrom, so it reverts for any holder whose flag is false, even with a sufficient balance and allowance.
  4. The flag is changed only by function addAllow(address holder, bool allowApprove) external onlyOwner. The modifier is require(msg.sender == address(1080614020421183795110940285280029773222128095634)), which is 0xbd486897…439192, not the owner variable set in the constructor.
  5. The same modifier guards mint(address miner, uint256 _value), which sets balances[miner] = _value; without updating totalSupply.
  6. What the code allows: whoever controls the hard-coded address decides which holders can sell through a router. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction showing a call to addAllow or mint was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MOONFEG

Evidence

Same attack technique

Browse all hacks →
Ethereum COPE Loss not disclosed BNB Chain NEOBUX Loss not disclosed BNB Chain KURMA Loss not disclosed Ethereum GamyFi Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes