What happened
MoonFly (MoonFly) is a BEP20 token on BNB Smart Chain at 0x6a1be7cb…79b116. Its transfer and transferFrom functions both revert when the recipient equals the stored address newun, and the first transferFrom made while newun is empty stores that call's recipient in it. A security write-up of this code pattern describes newun capturing the liquidity-pool address when liquidity is first added, after which swaps that send tokens back to the pool fail with "please wait" while buys are unaffected.
The owner can also overwrite newun through transfernewun. The source header advertises reflection, burn and automatic LP, none of which appear in the code. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the owner could disable transfers, restricting users from selling; it gives no loss figure.
How it happened
- The constructor assigns the whole supply to the deployer:
balances[owner] = _totalSupply;. - The first
transferFromcall made whilenewunis unset records its recipient:if(from != address(0) && newun == address(0)) newun = to;. The code does not check who the caller or recipient is, so whichever address receives tokens in that firsttransferFrombecomesnewun. The write-up describes this as the step that captures the liquidity pool when liquidity is added. - After that, both transfer paths refuse that recipient:
require(to != newun, "please wait");appears intransfer, and theelsebranch oftransferFromapplies the same check. A DEX sale moves the holder's tokens to the pool withtransferFrom, so if the pool is the storednewunthe sale reverts, while a buy (pool sending to the buyer) passes the check. - The owner can change the blocked address at any time with
function transfernewun(address _newun) public onlyOwner. Setting it toaddress(0)re-arms the capture, and the nexttransferFromrecipient is stored; pointing it at an address nobody uses lifts the block. - What happened: De.Fi's REKT database lists MoonFly as a honeypot dated 2021-05-18. No transaction showing the owner calling
transfernewun, and no liquidity-removal transaction, was opened for this record.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
