MoonSafebank Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists MoonSafebank, a BNB Smart Chain token at 0x6a61aba0…3bf752, as an Exit Scam/Honeypot dated 2021-04-22 and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source shows a single destination address, newun, that transfer and transferFrom refuse to send tokens to, with the revert message please wait. The first transferFrom call made while newun is empty sets newun to its recipient, and the owner can change it with transfernewun.

A sale that sends tokens to the address held in newun therefore reverts, and the holder's balance is not debited. The source alone does not show which address newun holds on-chain or what any holder lost, and De.Fi gives no loss figure.

How it happened

  1. The owner address receives the whole supply in the constructor, and the contract defines address public newun; with no initial value.
  2. transfer begins with require(to != newun, "please wait");, so no holder can send tokens to the address stored in newun.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. While newun is the zero address, the first transferFrom call is allowed and stores its recipient as newun, with no other check on who made the call. Every later transferFrom to that recipient reverts. The cryptot3ddybear article on this pattern describes that first call as the liquidity add, which stores the pool address; the article does not cover MoonSafebank and this record does not show what newun holds on-chain.
  4. If newun is the pool, a sell moves tokens to it and the call reverts, and because the revert undoes the balance change the holder keeps their tokens. Transfers between ordinary wallets still pass.
  5. The owner can call transfernewun(address _newun) (onlyOwner). Setting it back to the zero address lets the next transferFrom capture a new recipient, and pointing it at an address that is never used lifts the block. The code allows this; the source alone does not show that either call was made.
  6. clearCNDAO() lets the owner send the contract's own BNB balance to itself. This does not touch holders' token balances.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MoonSafebank

Evidence

Same attack technique

Browse all hacks →
BNB Chain MEGAMOON Loss not disclosed BNB Chain Private Token Offering Loss not disclosed BNB Chain DogeDAO Loss not disclosed BNB Chain moonpirate Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes