What happened
Dark Comics NFT (DCNFT) is an Ethereum token whose transferFrom rejects transfers from ordinary holders. Every transfer passes through ensure, which lets it through only when the sender is the owner, the recipient is the owner, the sender is the owner-set tradeAddress, or the sender is on the owner-controlled canSale list. For every other sender it calls condition, which returns false while _saleNum, _minSale and _maxSale are all zero, and no function in the contract ever sets them.
De.Fi's REKT database lists the token as an exit scam/honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor records the deployer as
ownerand gives it the whole supply:owner = msg.sender; balanceOf[msg.sender] = totalSupply;. transferforwards totransferFrom, andtransferFromrequiresrequire(ensure(_from, _to, _value));before any balance moves, so every transfer is gated byensure.ensurereturns true only for privileged parties:if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. A holder sending to any other address, such as a trading pair, is not on that list and falls through torequire(condition(_from, _value));.conditionbeginsif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. These three variables areprivate, default to zero, and are never assigned anywhere in the contract (the only related write is_onSaleNum[_from]++), soconditionreturns false for every ordinary sender and the transfer reverts.- The owner holds the levers that open the gate.
transferownership(addr)only setstradeAddress = addr(it does not changeowner), andapproveAndCall(spender, addedValue)setscanSale[spender]=trueand can also overwrite a balance withbalanceOf[spender] = addedValue*(10**uint256(decimals));without touchingtotalSupply.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
