NftFinal Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NftFinal is a BEP20 token on BNB Smart Chain at 0xe82ade4c…dfbad5. Its transfer and transferFrom functions reject any transfer whose recipient equals a stored address named newun. In transferFrom, the first call made while newun is empty stores that call's recipient as newun, and the owner can later change it with transfernewun.

A researcher's write-up of this same code pattern on other tokens describes newun being set to the liquidity pool address when liquidity is added, which blocks sells with a "please wait" error. De.Fi's REKT database lists NftFinal as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. No transaction was opened that shows what newun held for this token.

How it happened

  1. The constructor sets symbol = "NftFinal", name = "NftFinal", decimals = 18 and _totalSupply = 1000000000000000000000000000000000, and credits the whole supply to the deployer with balances[owner] = _totalSupply;.
  2. transfer starts with require(to != newun, "please wait");, so no direct transfer can end at the newun address.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. While newun is empty, the first transferFrom call skips the check, goes through, and stores its own recipient in newun. Adding tokens to a DEX pool through a router uses transferFrom, so the pool address is a natural recipient of that first call; the researcher's write-up describes this for the pattern, and the code here does not show which address was stored.
  4. After newun is set, every later transferFrom and transfer to that address reverts with "please wait". A holder selling through a router sends tokens to the pool with transferFrom, so the sale reverts if the pool is newun. The owner is not exempt from this check, and transfers to other addresses still pass.
  5. The owner can change the target at any time with function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address makes the next transferFrom recipient become newun again. Owned has no renounce function.
  6. clearCNDAO is owner-only and sends the contract's own native-coin balance to the owner: _owner.transfer(address(this).balance);.
  7. What happened: De.Fi's REKT database lists this token as an Exit Scam/Honeypot dated 2021-04-25. No sale, liquidity or transfernewun transaction was opened, so none of those events is claimed.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NftFinal

Evidence

Same attack technique

Browse all hacks →
BNB Chain Zevia Loss not disclosed BNB Chain BitLink Loss not disclosed Ethereum The Crypto Prophecies Loss not disclosed Ethereum Mochi.market Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes