What happened
TheMountain ($MNTN) is a BNB Chain token at 0xe4dc7cea…f01acf whose transfer and transferFrom functions refuse any transfer whose recipient equals a stored address called newun. The owner can set newun to any address with transfernewun, and transferFrom also fills it automatically with the recipient of the first call made while it is empty. If newun holds a liquidity pool address, sells into that pool revert with "please wait" while buys out of the pool are not affected by this check.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor gives the whole supply to the deployer:
balances[owner] = _totalSupply;. transferFromcontainsif(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The firsttransferFrommade whilenewunis empty stores its recipient innewunwithout reverting. The code does not say who that recipient is; a liquidity-addingtransferFromto a pool would store the pool address.- From then on every
transferFromruns therequire(to != newun, ...)branch, andtransferalways runsrequire(to != newun, "please wait");. A sale that moves a holder's tokens to the stored address reverts, so ifnewunis the pool the holder cannot sell into it. A transfer from the pool to a buyer has a different recipient and passes this check. - The owner can change the block at any time:
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address lets the nexttransferFromcapture a new recipient; pointing it at an unused address lifts the block. The contract has no function to give up ownership, onlytransferOwnershipandacceptOwnership.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
