What happened
NanoCore (NANOCORE) is an Ethereum token copied from the cVault CORE design. For five days after its 25 October 2020 deployment, users sent ETH to the token contract through addLiquidity(), and on 30 October 2020 addLiquidityToUniswapNANOCORExWETHPair() placed 60.094 WETH and the full 10,000 NANOCORE supply into a Uniswap V2 pool, with contributors able to claim the LP tokens. Every NANOCORE transfer, including the pool paying out tokens when liquidity is removed, runs through an external "transfer checker" contract that the owner can replace at any time, so the owner decides whether tokens and LP positions can move.
De.Fi's REKT database lists the project as abandoned, with LP tokens that cannot be used to remove liquidity; about 62 WETH was still sitting in the pool when checked on 30 September 2026.
How it happened
- The constructor mints the whole supply to the token contract itself:
_mint(address(this), initialSupply);withinitialSupply = 10000e18. - During the 5-day event, users send ETH with
addLiquidity(bool ...), capped per address byif (ethContributed[sender] + value <= 2.5 ether), and the ETH stays in the token contract. - While that ETH sits in the contract, the owner can move it to any address with
function _convertWETH(address payable wethAddress, uint amount) payable public onlyOwner { wethAddress.transfer(amount); }, despite the name. - After the event,
addLiquidityToUniswapNANOCORExWETHPair()wraps the ETH, moves the token balance into the pair and mints LP tokens to the token contract; contributors then callclaimLPTokens()to receive their share. - Every token movement calls an owner-chosen contract:
IFeeApprover(transferCheckerAddress).calculateAmountsAfterFee(sender, recipient, amount);, set throughsetShouldTransferChecker(address) public onlyOwner. If that contract reverts, every NANOCORE transfer reverts, including the pool sending NANOCORE out when LP holders remove liquidity. It can also route up to the full amount to the owner-setfeeDistributor, because the only check is that the two outputs add up toamount.
Protocol details
Evidence
- transaction NANOCORE contract creation transaction etherscan.io
- transaction addLiquidityToUniswapNANOCORExWETHPair transaction etherscan.io
- address NANOCORE verified source code etherscan.io
- address Uniswap V2: NANOCORE pair on Etherscan etherscan.io
- analysis Sourcify match for 0x12B28e6fffA7ff813B15b597d894d5eF5b0b7428 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
