Nemo Finance Honeypot

Reported loss $32K
Ethereum
Honeypot

What happened

NEMO.FINANCE (NEMO, Ethereum, contract 0x2f37B7F2…05d02a) gives its owner two powers over holders. addAdmin lets the owner flag any address, and _executeTransfer then reverts every transfer whose sender is that address, so a flagged holder cannot sell or move tokens. addWork lets the owner mint any amount to any address without raising totalSupply, so the supply figure never shows the new tokens. De.Fi's REKT database lists the token as an exit scam/honeypot with $31,797 lost on 2020-10-26. Etherscan shows the deployer wallet 0x8b07780c…B771FC adding liquidity of 100,000 NEMO and 30 ETH at 11:05 UTC, calling addWork at 12:25 UTC to mint tokens to itself, swapping 100,000 tokens for 86.3 WETH 51 seconds later, and sending about 112.9 ETH to 0x5892221e…4fD131 at 02:16 UTC on 2020-10-27.

Transactions listed by De.Fi:

How it happened

  1. The constructor sends the whole 100,000 NEMO supply to a hard-coded address and makes the deployer the owner: _supply(initialSupplySend, _totalSupply); then _owner = msg.sender;. That address, 0x8b07780c…B771FC, is also the deployer.
  2. What the code allows: the owner can call addAdmin(account), which sets addadmin[account] = true. Every transfer path ends in _executeTransfer, whose first line is require(!addadmin[_from], "error");. A sale through a router runs transferFrom(holder, pair, value), so _from is the holder and a flagged holder's sell reverts. removeAdmin clears the flag. No opened transaction shows addAdmin being called.
  3. What the code allows: addWork(address account, uint256 amount) is owner-only and calls _supply(account, amount). _supply adds to _balances[account] and emits Transfer(address(0), ...) but never changes _totalSupply, and there is no cap. The contract has no function to change or renounce the owner.
  4. What happened, per Etherscan: the deployer added 100,000 NEMO and 30 ETH of liquidity at 11:05 UTC on 2020-10-26, which put its whole initial balance into the pair. At 12:25:55 UTC the same wallet called addWork, and the page shows tokens minted from the zero address to it. At 12:26:46 UTC it swapped 100,000 tokens for 86.3 WETH.
  5. At 02:16 UTC on 2020-10-27 the deployer wallet sent about 112.9 ETH to 0x5892221e…4fD131. An X post the same day warned that the contract had an unlimited mint function and that supply had been overridden by about 300%.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NEMO
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum KeeperDAO $170K lost Ethereum Horus Finance $991 lost Ethereum Lootx Finance $3K lost Ethereum Trump Swap $795 lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes