MoonWait Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

MoonWait was a BNB Chain token (0x8afcf0ae…ccb1c2, deployed on 15 April 2021) built on a known "stealthy LP block" template. The first transferFrom call, normally the router moving tokens into the new PancakeSwap pool when liquidity is added, stores the recipient in a variable named newun, and from then on every transfer to that address reverts with "please wait". Buying from the pool still works, but no holder can sell back into it.

The owner can repoint newun with transfernewun, and ownership was never renounced despite the code comments claiming "OwnershipTransferred to 0x000"; the advertised 10% burn and holder fee does not exist in the code. De.Fi's REKT database lists the token as a honeypot exit scam on 15 April 2021 in which the owner restricted users from selling; no loss figure is recorded.

How it happened

  1. The constructor sets name and symbol to "MoonWait" and credits the whole supply, _totalSupply = 1000000000000000000000000000000000 (10^15 tokens at 18 decimals), to the deployer as owner.
  2. In transferFrom, if(from != address(0) && newun == address(0)) newun = to; saves the first recipient. When liquidity is added through the PancakeSwap router, the router calls transferFrom from the owner to the pool, so the pool becomes newun.
  3. After that, transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. Buys move tokens from the pool to the buyer and pass; a sale moves tokens to the pool and reverts.
  4. transfernewun(address _newun) public onlyOwner lets the owner change the blocked address at any time, so the owner can open or close the pool for sells.
  5. The header comments advertise a 10% fee split between burn and holders, ownership renounced to 0x000 and liquidity "locked 4ever". The code has no fee logic, and ownership can only change through the two-step transferOwnership and acceptOwnership, which the zero address can never accept.
  6. clearCNDAO() lets the owner withdraw any BNB held by the token contract, which accepts BNB through its payable fallback.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MoonWait

Evidence

Same attack technique

Browse all hacks →
BNB Chain ELONSAFE Loss not disclosed BNB Chain MOONBERRY Loss not disclosed Ethereum Mechadog Loss not disclosed BNB Chain Volcano Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes