MoonWhale Honeypot

What happened

De.Fi's REKT database lists MoonWhale (MOONWHALE) as an Exit Scam/Honeypot on BNB Smart Chain and says the owner could disable the transfer function, restricting users from selling. In the verified code, transfer is unrestricted but transferFrom, the call a router uses to pull tokens from a seller, requires allow[_from] == true. Only the deployer is whitelisted in the constructor, and only a hard-coded address can add other holders to the whitelist, so ordinary holders can receive tokens but cannot sell through an approval-based swap.

How it happened

1. The constructor gives the whole supply to the deployer and whitelists it: balances[msg.sender] = totalSupply; and allow[msg.sender] = true;.
2. transfer has no whitelist check, so tokens can leave the deployer or a pool by plain transfer. A buyer can therefore receive tokens.
3. transferFrom adds a whitelist check on the account being debited: require(allow[_from] == true);. A holder who is not whitelisted can still call approve, but any transferFrom spending that holder's balance reverts, which is the path a router uses when a holder sells.
4. Whitelisting is controlled by addAllow(address holder, bool allowApprove) external onlyOwner, and the modifier is modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That constant is the address 0xbd486897…439192 in hex form, not the owner variable, and it differs from the deployer 0x6fca8885…AA2765. The code does not show who controls it.
5. Because onlyOwner ignores the owner variable, transferOwnership only rewrites that variable and does not move the whitelist power, and there is no renounceOwnership.
6. mint(address miner, uint256 _value) is also restricted to that address and sets balances[miner] = _value;. It overwrites the balance and does not touch totalSupply.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MOONWHALE

Evidence

• report @Token_Sniffer incident report twitter.com
• address MoonWhale verified source on BscScan bscscan.com
• analysis Sourcify repository copy of the same contract repo.sourcify.dev