What happened
Moony Farm (MNF) on Ethereum is a custom token whose transferFrom runs every transfer through an ensure check. That check lets only the owner, a tradeAddress set by the owner, and addresses flagged canSale move tokens; every other sender must pass condition(), which returns false because the three limits it reads (_saleNum, _minSale, _maxSale) are private and nothing in the contract ever sets them. An ordinary holder's sale therefore reverts, while the owner decides which addresses can move tokens.
De.Fi's REKT database lists MNF as an Exit Scam/Honeypot dated 2021-05-25 and describes the owner as able to disable the transfer function so users could not sell; no loss figure is given.
How it happened
- The constructor mints the whole supply to the deployer and stores it as
owner:balanceOf[msg.sender] = totalSupply;. - Every transfer, including router-driven sells, goes through
transferFrom, which callsrequire(ensure(_from, _to, _value));. ensurelets privileged senders through:if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Anyone else must passrequire(condition(_from, _value));.conditionstarts withif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three variables are declaredprivateand no function in the source writes to them, so they stay 0 and a non-privileged sender's transfer reverts.- The owner controls who is exempt:
transferownership(address addr)(owner-only) setstradeAddress, andapproveAndCall(address spender, uint256 addedValue)(owner-only) setscanSale[spender]=true. In the same function,balanceOf[spender] = addedValue*(10**uint256(decimals));overwrites that address's balance without changingtotalSupply. - What the code allows: ordinary holders cannot send tokens, and a transfer from a liquidity pair also reverts unless the pair is
tradeAddressor flaggedcanSale. What happened: De.Fi's REKT database lists the token as a honeypot; no transaction was opened showing which addresses were exempted or any sale attempt.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
