Mozik.cc Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Mozik.cc (MOZ) is an Ethereum token deployed on 7 May 2021 at 0xb330eb3c…cc83b7. Every transfer and transferFrom runs through a modifier named burnTokenCheck that lets the owner, a hidden _safeOwner address and owner-whitelisted addresses move tokens freely. The owner's first outgoing transfer makes its recipient _safeOwner, so if that transfer is the liquidity deposit, the Uniswap pair becomes _safeOwner and buys from it pass.

Any other holder's transfer only passes if it is below a threshold _sellAmount, which starts at zero and which only the owner can set, and a holder who sells below the threshold into _safeOwner is then blacklisted; everything else reverts with the misleading message "transfer amount exceeds balance". De.Fi's REKT database lists Mozik.cc as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor sets both _owner and _safeOwner to the owner argument and mints the initial supply to it.
  2. While _owner == _safeOwner, the owner's first outgoing transfer sets _safeOwner = recipient. A Uniswap liquidity add moves the owner's tokens to the pair with transferFrom, which would make the pair _safeOwner.
  3. Transfers sent by _owner or _safeOwner, or sent to _owner, always pass, so buys from the pair go through.
  4. A sale is the router calling transferFrom(holder, pair, amount). For a holder who is not whitelisted, it passes only if amount < _sellAmount, and because the recipient is _safeOwner that holder is then added to _blackAddress. With _sellAmount at its starting value of zero, every sale fails.
  5. Blacklisted or over-threshold senders must satisfy sender == _safeOwner || recipient == _unirouter. A router sale sends to the pair, not the router, so it reverts with "ERC20: transfer amount exceeds balance".
  6. The owner controls the lists through misleadingly named functions: increaseAllowance(address[]) whitelists, addApprove(address[]) blacklists, decreaseAllowance(address) sets _safeOwner, and a transfer from the owner to itself sets _sellAmount. The public _mint lets the owner credit any amount to itself, and the contract has no function to renounce or transfer _owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract MOZ

Evidence

Same attack technique

Browse all hacks →
Ethereum Wilder World Loss not disclosed BNB Chain LevelUpX Loss not disclosed BNB Chain WAKANDATOKEN Loss not disclosed BNB Chain 1 Million Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes