QuickMOON Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

QuickMOON (QMOON, BNB Smart Chain, contract 0x18d71c4f…471ae2) has an owner-controlled list of recipient addresses to which tokens cannot be sent. Every transfer, whether transfer or transferFrom, passes through a check that reverts with the message 'Can not sell this token' when the recipient is on that list. If the owner lists the trading pair, every sale into it fails for all holders.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot, stating that the owner could disable the transfer function, which restricted users in selling their tokens. The code allows the owner to add or remove addresses from the list at any time; the sources opened do not show which addresses were listed or how much holders lost.

How it happened

  1. The constructor mints the full supply to the deployer: _transferTO(msg.sender, 1300000e18);.
  2. The owner can mark any address with setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner, which stores PanCakeSwapReciever[_recipient] = _feeless;. The flag can be set to true or false at any time.
  3. Both transfer and transferFrom call _transfer, which calls calculateFeesBeforeSend(sender, recipient, amount).
  4. That function contains if(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }. The revert undoes the whole call, including the earlier _balances[sender] subtraction, so no tokens move and no one is exempt from it, the owner included.
  5. If the owner flags a pair address, a swap that sends tokens to that pair reverts. The code does not show which address, if any, was flagged.
  6. seTxFee is capped by require(_ff <= 100, "Error: Fees cannot go above 10%");, but calculateFeesBeforeSend ends with return (amount, 0);, so txFee is never deducted from a transfer.
  7. renounceOwnership exists. Renouncing would stop further setPanCakeSwapReciever calls but would not clear flags already set. meta.json's current-state read (2026-09-30) lists 0xf58ef7b1…7ed967 as owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract QMOON

Evidence

Same attack technique

Browse all hacks →
BNB Chain SolaceToken Loss not disclosed BNB Chain SafeTeslaCoil Loss not disclosed BNB Chain Nuclear Product Loss not disclosed Ethereum Tribe Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes