MoonPay Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonPay (MPAY) is a BEP-20 token on BNB Chain at 0xe75ece59…bd3fdf, deployed on 28 April 2021 at 06:07 UTC. De.Fi's REKT database lists it as an exit scam/honeypot. Its transferFrom function only works for holders marked true in an allow mapping, and the constructor marks only the deployer.

A DEX router sells tokens through transferFrom, so holders can buy but their sells revert. Only the hard-coded address 0xf7E1F5a3…432982 can add wallets to allow, through addAllow.

How it happened

  1. The constructor gives the whole supply to the deployer and sets allow[msg.sender] = true, so the deployer can move tokens with transferFrom and add liquidity through a router.
  2. Buyers purchase MPAY from the pair. The pair pays out with transfer, which only checks the recipient and balance, so buys succeed.
  3. To sell, a holder approves the router, and the router calls transferFrom(holder, pair, amount). That function contains require(allow[_from] == true);, and a buyer's entry in allow is false by default, so the sale reverts.
  4. The whitelist can only be changed through addAllow(address holder, bool allowApprove), guarded by onlyOwner, and onlyOwner checks msg.sender == address(0xf7E1F5a3B02178BAFBAE0c6C080622669c432982) rather than the stored owner. That single address decides which wallets may sell through the router.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MPAY

Evidence

Same attack technique

Browse all hacks →
BNB Chain Safecare Loss not disclosed BNB Chain SPACEPENGUIN Loss not disclosed BNB Chain TACHYON Loss not disclosed BNB Chain Instaswap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes