Mother Of Dragon Honeypot

What happened

Mother Of Dragon (MODRAGON) is an Ethereum token whose transfer and transferFrom functions refuse any transfer to a stored address called newun, reverting with the message "please wait". The first transferFrom call, while newun is unset, stores its recipient as newun, so a liquidity-adding call that sends tokens to the pair would register that pair as the blocked address and make later sales into it revert. The owner can also change newun with transfernewun.

De.Fi's REKT database lists the token as an exit scam/honeypot, saying the contract owner could restrict users from selling.

How it happened

1. The constructor gives the whole supply to the deployer: balances[owner] = _totalSupply;. The contract has an onlyOwner function transfernewun(address _newun) that sets newun.
2. In transferFrom, the first call made while newun is empty sets it to the recipient: if(from != address(0) && newun == address(0)) newun = to;. Nothing in the code checks that this recipient is a trusted address.
3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer always runs require(to != newun, "please wait");. Any transfer into the stored address reverts, and no balance is debited because the revert undoes it.
4. If the stored address is the trading pair (the code alone does not show this; the linked write-up describes it for similar tokens), buys still work because tokens leave the pair, but a holder's sale sends tokens to the pair and reverts with "please wait".
5. The block can be lifted or re-armed only by the owner: pointing newun at an unused address lets transfers into the pair succeed, while setting it to address(0) lets the next transferFrom capture a new recipient. The owner also has clearCNDAO, which sends the contract's own native-currency balance to the owner.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract MODRAGON

Evidence

• report @Token_Sniffer incident report twitter.com
• report Mother Of Dragon contract source (Sourcify match) repo.sourcify.dev
• report De.Fi REKT database listing for MODRAGON (proof link Token Sniffer post, not retrievable) twitter.com
• address Mother Of Dragon contract source (Etherscan code tab) etherscan.io
• analysis Scam explained: stealthy LP block (newun) cryptot3ddybear.gitlab.io