WenMoon Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

WenMoon (WenMoon) is a 9-decimal token on BNB Chain whose transfer and transferFrom both revert when the recipient equals a stored address called newun. newun starts empty and is filled by the first transferFrom call, which stores that call's recipient. If the first transferFrom is the liquidity deposit through a router, the liquidity pair becomes newun and every later sale into the pair reverts with please wait, while purchases out of the pair are not restricted.

The owner can also repoint newun with transfernewun. De.Fi's REKT database lists the token as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. The constructor credits the whole supply to the deployer: balances[owner] = _totalSupply; with _totalSupply = 1000000000000000000000000 raw units at 9 decimals. newun is never set in the constructor, so it starts as the zero address.
  2. The first transferFrom from a non-zero sender takes this branch: if(from != address(0) && newun == address(0)) newun = to;. That transfer succeeds and its recipient is stored as newun. A router-based liquidity deposit calls transferFrom from the owner to the pair, so the code allows the pair to become newun.
  3. Every later call is checked against newun. transferFrom runs else require(to != newun, "please wait"); and transfer runs require(to != newun, "please wait");. A sale through a router calls transferFrom(holder, pair, amount), so the recipient equals newun and the call reverts. Buys are transfer calls from the pair to the buyer, whose recipient is not newun, so they go through.
  4. The check has no exception for the owner or any whitelist, so it applies to every sender. The owner alone can change it with function transfernewun(address _newun) public onlyOwner. Pointing newun at an unused address lifts the block; setting it back to zero re-arms the capture, and the next transferFrom passes and stores its recipient.
  5. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. A blog post dated 2021-04-11 documents the same newun pattern in other tokens (SafeRocket and similar), where the pair is captured during the first liquidity add; it does not mention WenMoon, and no transaction for this token was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract WenMoon

Evidence

Same attack technique

Browse all hacks →
BNB Chain One Loss not disclosed BNB Chain NFTbs Loss not disclosed Ethereum Governor Network Loss not disclosed Ethereum Charged Particles Protocol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes