NFTbs Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NFTbs (NFTb) on BNB Smart Chain, contract 0x7a60e753…7ee745, stores an address in newun and reverts any transfer or transferFrom whose recipient is that address with the message please wait. newun is empty at deployment and is filled by the first transferFrom call, with whatever recipient that call has. If that first call is the one that supplies liquidity to a trading pair, the pair becomes the blocked recipient, so later sells into it revert while buys out of it do not meet the check.

Only the owner's transfernewun can change the stored address. De.Fi's REKT database lists the token as an exit scam/honeypot and says the contract owner could disable transfers, which restricted users from selling; a write-up in its proof field describes this same newun pattern in other BSC tokens.

How it happened

  1. At deployment the Owned constructor sets owner = msg.sender and the whole supply goes to the owner. newun is empty.
  2. The first transferFrom with a non-zero from runs if(from != address(0) && newun == address(0)) newun = to;. It records the recipient and then moves the tokens, with no check on who the recipient is. If this call is the liquidity add, the stored address is the pair.
  3. After that, every transferFrom takes the else branch: else require(to != newun, "please wait");, and transfer has its own require(to != newun, "please wait");. A sell through a router is a transferFrom(holder, pair, amount), so with newun set to the pair the call reverts and the holder's balance is not debited.
  4. Transfers whose recipient is any other address still work, for example a pair paying out to a buyer, which is why the token can look tradable from the buy side.
  5. The owner controls the block: function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Setting it to the zero address re-arms the capture at the next transferFrom; pointing it at an address nobody uses lifts the block. The contract has no renounceOwnership, only transferOwnership and acceptOwnership.
  6. What happened: De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-06-01. No opened source shows the value of newun, any failed sell, or any loss figure.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NFTb

Evidence

Same attack technique

Browse all hacks →
BNB Chain Iron Mars Loss not disclosed BNB Chain One Loss not disclosed BNB Chain WenMoon Loss not disclosed Ethereum Governor Network Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes