MOONSUN Honeypot

What happened

MOONSUN is a BNB Smart Chain token whose transferFrom records the recipient of the first call as newun and from then on reverts any transfer or transferFrom sent to that address with please wait. If that first call was the initial liquidity addition, newun is the liquidity pair, so selling tokens into the pool fails. The owner can change newun at any time with transfernewun.

De.Fi's REKT database lists MOONSUN as an Exit Scam/Honeypot dated 2021-04-10 and says the owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor assigns the full supply of 1000000000000000000000000000000000 raw units (10^15 tokens at 18 decimals) to owner, which Owned sets to the deployer.
2. The first transferFrom made while newun is unset skips the check and stores its recipient: if(from != address(0) && newun == address(0)) newun = to;. The code does not show who made that call or who the recipient was.
3. From then on every transferFrom runs else require(to != newun, "please wait"); and every transfer runs require(to != newun, "please wait");. Nothing exempts the owner or any other address, so any transfer into newun reverts, including a router sale that pays tokens to a pair stored there.
4. Transfers to any other address, and transfers out of newun, are not restricted by this code.
5. function transfernewun(address _newun) public onlyOwner lets the owner overwrite newun. Setting it to address(0) re-arms the capture for the next transferFrom; pointing it at an address nobody uses lifts the block. There is no renounce function in the source.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MOONSUN

Evidence

• address MOONSUN verified source on BscScan bscscan.com
• analysis Sourcify repository entry for 0x8a3fcb9d16f532185e5987f53f80a70de82d3d64 repo.sourcify.dev