MoonkeyKong Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonkeyKong (MOKONG) is a BNB Smart Chain token whose code stores an address in a public variable called newun. The first transferFrom call with a non-zero from while newun is empty sets newun = to, and after that every transfer or transferFrom whose recipient is newun reverts with "please wait". When newun is a liquidity pair, that stops holders from sending tokens into it, which is how a sale on a DEX is executed, while buys are not covered by the check.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, describing a contract whose owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The TokenBEP20 constructor sets symbol = "MOKONG", name = "MoonkeyKong", decimals = 3 and gives the whole supply to owner. A public variable address public newun; starts empty.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first call with a non-zero from therefore records its recipient in newun without any check. If that call is the router moving tokens into a new liquidity pair, the pair address is the one captured.
  3. From then on, transferFrom takes the else branch and require(to != newun, "please wait") reverts any transfer whose recipient is newun. transfer has the same guard unconditionally: require(to != newun, "please wait");.
  4. A holder selling through a router calls transferFrom(holder, pair, amount). With newun set to the pair, to == newun and the call reverts. The check is on the recipient only, so a transfer from newun to another address, which is what a purchase from the pair is, is not blocked by it, and neither is the pair paying out to an address removing liquidity.
  5. The owner can change the guard. transfernewun(address _newun) is onlyOwner and overwrites newun. Pointing it at an address nobody uses lifts the block, while setting it to address(0) re-arms capture, so the next transferFrom call with a non-zero from records its recipient as the new blocked address.
  6. The Owned contract has only transferOwnership and acceptOwnership, and no function that renounces ownership. MoonkeyKong also exposes clearCNDAO(), restricted by onlyOwner, which sends the contract's own BNB balance to the owner. The owner() value read on 2026-09-30 was 0xedd4c563…f34656, the same address that deployed the contract; this is a current-state read, not a historical one.
  7. This describes what the code allows. The supplied source does not show which address newun held, whether it was ever changed, or whether any liquidity was removed on this deployment.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MOKONG

Evidence

Same attack technique

Browse all hacks →
Ethereum komainu.finance Loss not disclosed Ethereum JUST FAIR LAUNCH Loss not disclosed BNB Chain Shiba Diamond Loss not disclosed Ethereum Kyushu Inu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes