MoonQueen Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonQueen (BNB Smart Chain contract 0xd3d6b796…d5792a) assigns its entire supply of 1,000,000,000,000,000 tokens (18 decimals) to the deployer and guards every transfer with a single storage variable, newun. The first transferFrom call with a non-zero from stores its recipient in newun; after that, both transfer and transferFrom revert with please wait for any transfer to that address. A write-up by cryptot3ddybear describes newun being set to the liquidity pool address by the first add-liquidity transaction in this scam family, which makes a sell back into the pool revert.

Only the owner can change newun, through transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor assigns the whole supply to the deployer: _totalSupply = 1000000000000000000000000000000000; and balances[owner] = _totalSupply;.
  2. newun starts as the zero address. The first transferFrom whose from is not the zero address runs if(from != address(0) && newun == address(0)) newun = to;, so that transfer succeeds and records its recipient. cryptot3ddybear's write-up says that in this token family the recorded address is the liquidity pool, because the first transferFrom is the add-liquidity call.
  3. From then on every transfer to the recorded address reverts. transfer has require(to != newun, "please wait"); and transferFrom reaches the same check through its else branch. A router sell calls transferFrom(holder, pair, amount), so if newun is the pair it reverts and the tokens stay with the holder. A transfer out of the pair to a buyer is not blocked by this check.
  4. The owner controls the lock: transfernewun(address _newun) is onlyOwner and overwrites newun with any address. Pointing it at an unused address lifts the block; setting it to the zero address lets the next transferFrom with a non-zero from capture a new recipient.
  5. The code only shows what the owner can do. No transaction was opened showing the owner calling transfernewun, withdrawing liquidity, or selling; the loss to buyers rests on De.Fi's listing.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MoonQueen

Evidence

Same attack technique

Browse all hacks →
BNB Chain HYPERIONMOON Loss not disclosed BNB Chain Glacier Loss not disclosed BNB Chain MickeyMars Loss not disclosed BNB Chain Enceladus Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes