NFT ECO Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists NFT ECO (NFTE, BNB Smart Chain, contract 0x3fef8a55…416303) as an Exit Scam/Honeypot dated 2021-05-22 and says the owner could disable transfers so holders could not sell. In the verified source, transfer and transferFrom revert with "please wait" for any transfer whose recipient equals a stored address newun. newun is filled automatically by the first transferFrom call and the owner can overwrite it with transfernewun.

If newun holds the liquidity pair address, a sell through the router reverts, because the router pulls tokens with transferFrom(holder, pair, amount).

How it happened

  1. The token stores an address address public newun;, empty at deployment.
  2. On the first transferFrom call, if(from != address(0) && newun == address(0)) newun = to; copies that call's recipient into newun. The code does not check who the caller or recipient is. A liquidity addition through a router is a transferFrom into the pair, so the recipient of that first call would be the pair address; the code alone does not show which address was stored.
  3. After newun is set, every later transferFrom runs else require(to != newun, "please wait");, and every transfer runs require(to != newun, "please wait");. Neither function exempts the owner or any other address.
  4. A holder selling through a router calls transferFrom(holder, pair, amount). If newun is the pair, to == newun and the call reverts before the balances[from] = balances[from].sub(tokens); line, so the holder keeps the tokens but cannot sell them. Buys move tokens out of the pair, so they do not trip the check.
  5. The owner can change the blocked address at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to address(0) re-arms the capture on the next transferFrom; pointing it at an unused address lifts the block. Whether the owner called it is not shown without a transaction.
  6. The NFTECO contract also has clearCNDAO(), which lets the owner send the contract's whole BNB balance to itself, and a payable fallback that accepts BNB. Whether the contract ever held BNB is not established.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NFTE

Evidence

Same attack technique

Browse all hacks →
BNB Chain Kobe Loss not disclosed BNB Chain ORANGE TOKEN Loss not disclosed Ethereum LIGMA Loss not disclosed BNB Chain RUSHMOON Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes