New Deep Thots Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

New Deep Thots (NDT) is a BEP20 token on BNB Smart Chain with an owner-controlled switch that blocks transfers into one address. toggleFund(true) makes transfer and transferFrom revert whenever the recipient is currentOwner, and currentOwner is filled automatically with the recipient of the first transferFrom call. If that address is the liquidity pool, sells revert while buys still work.

The contract also has an owner-only pcsLiquidity function that creates new tokens for the caller. De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the contract owner could disable the transfer function, restricting users from selling their tokens.

How it happened

  1. modifier setcurrentOwner(address _to) { if (currentOwner == address(0)) currentOwner = _to;_; } is applied to transferFrom, so the first transferFrom call stores its recipient in currentOwner. The code does not say which address that is; if the first call is the liquidity deposit, it would be the pool.
  2. modifier transmitCredit(address request) { if (Fund) require(parseCurrentState(request));_; } with parseCurrentState returning request != currentOwner makes both transfer and transferFrom revert for transfers to currentOwner once Fund is true.
  3. toggleFund(bool _state) is guarded by onlyOwnerPermission, which accepts msg.sender == currentOwner || msg.sender == totalsupply (the deployer, set in the declaration address totalsupply = msg.sender;). The flag defaults to false, so the block is dormant until someone with that permission switches it on.
  4. With Fund on and currentOwner set to the pool, a sell, which sends tokens to the pool, reverts, while buys that move tokens out of the pool to other addresses still work. The transferring holder's balance is only debited when the call succeeds.
  5. pcsLiquidity(uint256 _input) public onlyOwnerPermission calls emitTransfer(_msgSender(), _input), which adds _input to the caller's balance without increasing totalSupply. renounceOwnership(address _currentOwner) only rewrites the public owner variable and does not change onlyOwnerPermission.
  6. What happened: De.Fi's REKT database lists this token as a honeypot/exit scam. No transaction showing toggleFund being called, pcsLiquidity minting, or liquidity removal was opened, and no loss figure is given.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NDT

Evidence

Same attack technique

Browse all hacks →
BNB Chain PI NETWORK TOKEN Loss not disclosed BNB Chain KING TRUMP Loss not disclosed BNB Chain Telcoin Loss not disclosed Ethereum Virgin Elon Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes