xrpmoon Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

xrpmoon is a BNB Smart Chain token whose transferFrom stores the recipient of the first call in a variable called newun, and from then on rejects every transfer or transferFrom addressed to that account with the message "please wait". Because a sale moves tokens to the liquidity pair, a pair captured as newun blocks selling while buying, which pays out from the pair, still works. The owner can overwrite newun at any time with transfernewun.

De.Fi's REKT database lists the token as an exit scam/honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

  1. newun starts as the zero address, and transfernewun(address _newun) lets the owner set it to any address.
  2. In transferFrom, the line if(from != address(0) && newun == address(0)) newun = to; runs on the first call: the recipient of that first transferFrom becomes newun and that transfer goes through.
  3. Every later transferFrom takes the else require(to != newun, "please wait"); branch, and transfer has require(to != newun, "please wait");, so any transfer whose recipient is newun reverts.
  4. If the captured recipient is the liquidity pair (as in a router-based liquidity add, where the router pulls tokens with transferFrom), a holder's sale reverts. The balance is only debited after the check, so the revert leaves the holder's tokens untouched and unsellable.
  5. Transfers to any other address, and transfers out of the pair, are not checked, so purchases are not blocked by this line.
  6. The owner can lift the block by pointing newun at an unused address with transfernewun, or re-arm capture by setting it back to the zero address, which makes the next transferFrom capture a new recipient. The file contains no renounceOwnership.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract xrpmoon

Evidence

Same attack technique

Browse all hacks →
BNB Chain MirrorFinance Loss not disclosed BNB Chain SafeGate Loss not disclosed BNB Chain SafePaid Loss not disclosed BNB Chain EXEEDME.FINANCE Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes