NFT Farm Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NFT Farm (NFTF) is a BNB Chain token whose transfer check rejects every transfer by an ordinary holder, including a sale into a PancakeSwap pool. Both transfer and transferFrom call ensure, which only lets a transfer through if it comes from the owner, goes to the owner, comes from the owner-chosen tradeAddress, or comes from an address the owner has flagged in canSale. Every other transfer must pass condition, which returns false while _saleNum, _minSale and _maxSale are all zero, and the contract has no function that sets them.

The owner can also give any address any balance through a function disguised as approveAndCall. De.Fi's REKT database lists the token as an exit scam/honeypot.

How it happened

  1. The constructor credits the full supply to the deployer, stored in a private owner variable.
  2. transfer forwards to transferFrom, and both run require(ensure(_from, _to, _value)).
  3. ensure returns true immediately only if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]); otherwise it calls condition.
  4. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;, and no function in the contract ever writes these three variables, so every other transfer reverts.
  5. The owner can set tradeAddress through transferownership(address addr), which does not change the owner. If tradeAddress is the PancakeSwap pair, tokens can leave the pair to buyers while holders cannot send tokens back into it.
  6. approveAndCall(spender, addedValue) is owner-only, overwrites balanceOf[spender] with any amount without changing totalSupply, and flags the address in canSale so it can sell freely.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NFTF

Evidence

Same attack technique

Browse all hacks →
BNB Chain CURLYPUFF Loss not disclosed BNB Chain SonicSwap Loss not disclosed BNB Chain E=MCv2 Loss not disclosed BNB Chain Symbol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes