Avengers NFT Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Avengers NFT (AVENGE) was an Ethereum ERC-20 token whose transferFrom runs every transfer through an ensure check. Transfers pass only if they come from or go to the owner, come from a single tradeAddress the owner chooses, or come from a wallet the owner has whitelisted; every other transfer falls through to condition, which always returns false because its three sale limits are never set anywhere in the contract. If the owner points tradeAddress at the Uniswap pair, buys from the pair go through while ordinary holders can never send tokens back to sell.

A hidden owner function named approveAndCall can also overwrite any wallet's balance and whitelist it to sell. Etherscan labels both the contract and its deployer as Fake_Phishing, and De.Fi's REKT database lists AVENGE as an exit scam / honeypot dated 2021-04-06.

How it happened

  1. The deployer receives the full 120,000 AVENGE supply and becomes the private owner (balanceOf[msg.sender] = totalSupply;).
  2. Every transfer is routed into transferFrom, which calls require(ensure(_from, _to, _value));.
  3. ensure lets a transfer through only when _from == owner || _to == owner || _from == tradeAddress||canSale[_from]. Otherwise it requires condition(_from, _value).
  4. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three variables are private and no function ever writes them, so this is always false and every transfer from an ordinary holder reverts, including a sell into the pool.
  5. The owner can set tradeAddress through a function misleadingly named transferownership(address addr), which does not change ownership. With tradeAddress set to the pair, tokens leaving the pair (buys) pass the check.
  6. The owner can call approveAndCall(address spender, uint256 addedValue), which runs balanceOf[spender] = addedValue*(10**uint256(decimals)); and canSale[spender]=true;. That lets the owner assign any balance to any wallet (without changing totalSupply) and exempt it from the sell block. There is no function to renounce or transfer the real owner.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract AVENGE

Evidence

Same attack technique

Browse all hacks →
BNB Chain FairVenus Loss not disclosed BNB Chain Hurricane Loss not disclosed BNB Chain Safe Fortune Loss not disclosed BNB Chain Aragorn Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes