NFTDragonBall Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NFTDragonBall (NFTDB) is a BNB Smart Chain token whose transfer and transferFrom refuse to send tokens to one stored address, newun. The first transferFrom made while newun is empty stores its recipient as newun; when that call is the first liquidity deposit, the recipient is the trading pair. Afterwards a sale through a router, which is a transferFrom into the pair, reverts with "please wait" for every holder, and the code contains no address exemption, not even for the owner.

De.Fi's REKT database lists the token as an exit scam/honeypot in which the owner could disable transfers and restrict users from selling; no sale attempt, transaction or loss figure was opened for this record.

How it happened

What the code allows:

  1. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to;. The first call with a non-zero from while newun is unset stores its recipient as newun and skips the check below. A liquidity deposit through a router is such a call, so newun would be the pair address.
  2. Every later transferFrom runs else require(to != newun, "please wait");. A holder selling through a router calls transferFrom(holder, pair, amount), so to == newun and the call reverts.
  3. transfer contains require(to != newun, "please wait");, so a direct transfer to newun also reverts. Neither function has an exemption for the owner or any other address.
  4. Transfers out of the pair to a buyer have to equal to the buyer, so they are not blocked: buying stays possible while selling into newun is blocked.
  5. transfernewun(address _newun) is onlyOwner and overwrites newun. Pointing it at an unused address lifts the block; setting it to the zero address re-arms the capture on the next transferFrom. The contract also has an onlyOwner transferOwnership.
What happened

De.Fi's REKT database lists NFTDragonBall as an exit scam/honeypot dated 2021-06-05 where holders were restricted from selling. No transaction showing the value of newun, a failed sale, a call to transfernewun, or a liquidity removal was opened for this record.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NFTDB

Evidence

Same attack technique

Browse all hacks →
BNB Chain HODLEPUFF Loss not disclosed Ethereum Wrapped AMC Loss not disclosed BNB Chain BLUEHYPER Loss not disclosed BNB Chain Excavator Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes