What happened
nebula is a BEP-20 token on BNB Chain at 0x6d3a0dd7…9c7bb4, deployed on 30 March 2021 by 0xF9Ed97e0…F6E9aa, which received the full 10 trillion token supply and is still the on-chain owner. De.Fi's REKT database lists it as an exit scam/honeypot, although the source header advertises it as "UNRUGGABLE" with a one-year liquidity lock. The code has no general on/off switch for transfer.
Instead, the first transferFrom call, normally the router adding liquidity, saves its destination (the PancakeSwap pair) in newun, and every later transfer to that address reverts with "please wait". Holders can buy from the pool but cannot sell into it, and the owner can repoint newun at any time with transfernewun.
How it happened
- The constructor credits the whole supply to the deployer:
balances[owner] = _totalSupply;. - When liquidity is added, the router pulls tokens with
transferFrom. Becausenewunis still empty,if(from != address(0) && newun == address(0)) newun = to;stores the destination, which is the PancakeSwap pair. - Buyers receive tokens from the pair through
transfer, which only rejects transfers whose destination isnewun, so buys succeed. - Selling means sending tokens to the pair.
transferchecksrequire(to != newun, "please wait");andtransferFromrunselse require(to != newun, "please wait");, so every sell reverts. - The owner can change the blocked address with
function transfernewun(address _newun) public onlyOwner, which can unblock the pair for chosen moments or block another address.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- transaction nebula contract creation transaction bscscan.com
- address nebula verified source code bscscan.com
- analysis Scam explained: BSC stealthy LP block cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x6d3a0dd7d14ea131b8a690f2ee0d362ec29c7bb4 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
