MoonSquirrel Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonSquirrel (MNSL) is a BNB Smart Chain token whose verified code contains an owner-controlled transfer block. The first transferFrom call made while newun is empty stores its recipient in newun; after that, every transfer or transferFrom whose recipient is newun reverts with the message "please wait". A write-up by CryptoT3ddyBear on the same code pattern says newun ends up holding the PancakeSwap liquidity pool address, which makes sells through the pool fail; that post does not name MoonSquirrel, and this contract's source does not itself show which address newun holds.

Only the owner can change newun, through transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot, saying the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor sets symbol = "MNSL", name = "MoonSquirrel" and assigns the whole _totalSupply of 100000000000000000000000000000000000000 raw units (1e20 tokens at 18 decimals) to owner.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; runs on the first call while newun is unset. It records the recipient of that call, whoever it is, and applies no check on that call.
  3. From then on the else branch runs: else require(to != newun, "please wait");. transfer has the same check, require(to != newun, "please wait");, so no caller, including the owner, can send tokens to newun.
  4. A swap that sells tokens pulls them with transferFrom(holder, pair, amount). If the pair is the address stored in newun, that call reverts and the holder's balance is not debited. The linked write-up describes this outcome for the pattern; this contract's code alone does not show which address newun holds.
  5. The owner can call transfernewun(_newun) at any time. Setting it to address(0) re-arms capture by the next transferFrom; pointing it at an address nobody uses lifts the block. Nothing in the source forces either.
  6. De.Fi's REKT database lists the token as an Exit Scam/Honeypot. The source contains no function that mints, blacklists or withdraws liquidity; clearCNDAO only sends the contract's own BNB balance to the owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MNSL

Evidence

Same attack technique

Browse all hacks →
Ethereum Crypto Puzzles Loss not disclosed Ethereum Polylastic Loss not disclosed Ethereum TrustPad Loss not disclosed Ethereum The Doge Space X Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes