PicaMoon Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

PicaMoon (PicaMoon) is a BEP-20 token on BNB Smart Chain at 0xe3a38711…b437e4. 0xAFF788Ea…cE0ebA deployed it on 13 April 2021 and received the whole 1,000,000,000,000,000 PicaMoon supply. A header comment in the source promises "TOKEN AND LP BURN 100% BEFORE LIST".

The code itself blocks selling. The first transferFrom from a non-zero address records its recipient in a variable named newun. When the owner adds PancakeSwap liquidity, that recipient is normally the liquidity pool.

After that, every transfer or transferFrom whose recipient is newun reverts with "please wait". Buys, where the pool sends tokens out, still work, but holders cannot sell into the pool. The owner can repoint newun at any address with transfernewun.

This is the stealthy liquidity-pool block that the blogger cryptot3ddybear described on 11 April 2021 for other BSC tokens using the same code.

How it happened

  1. The constructor credits the whole supply to the deployer: balances[owner] = _totalSupply;.
  2. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. While newun is unset, the first transferFrom from a real address stores its recipient. When the owner adds liquidity through the PancakeSwap router, the router pulls tokens with transferFrom into the pair, so the pair becomes newun.
  3. Every later transferFrom runs else require(to != newun, "please wait");, and transfer runs require(to != newun, "please wait");. Router sells move tokens to the pair with transferFrom, and direct sends to the pair use transfer, so both revert.
  4. Transfers out of the pair are not checked, so buyers can keep buying while the pool fills with BNB they cannot get back by selling.
  5. transfernewun(address _newun) public onlyOwner lets the owner change the blocked address at any time. Removing liquidity does not send tokens to the pair, so whoever holds the LP tokens can still withdraw the pool's BNB.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract PicaMoon

Evidence

Same attack technique

Browse all hacks →
BNB Chain EUROTRIP Loss not disclosed Ethereum Hord.App Loss not disclosed Ethereum Rocket Vault Loss not disclosed BNB Chain Photosynthesis Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes