What happened
NFTflow sold a 1,111-piece ERC-721 "Membership Pass" at 0.1 ETH per mint from a contract at 0x253954d2…fd51ca. Every mint payment stayed in the contract balance, and the contract has an owner-only withdraw() that sends the entire balance to the owner, with no vesting, refund path or delivery condition. De.Fi's REKT database lists the project as an exit scam / rug pull and states that the contract deployer withdrew all deposited ETH; the deployer's internal-transactions page (Address 0x5cad…9616) shows many ETH transfers from the contract to the deployer address 0x5cad06E1…059616 between 2022-03-13 and 2022-03-18, for example 11.4 ETH on 2022-03-13 and 12.2 to 13 ETH amounts on 2022-03-14.
De.Fi puts the loss at 216,386 USD. The listing's proof site (Source) did not resolve when checked.
How it happened
- The deployer deployed the
NFTFLOWcontract withsaleIsActive = trueand a price of 0.1 ETH (uint256 public tokenPrice = 100000000000000000;), so minting was open from deployment. - Buyers called
mint(),mint1()ormint2(uint256 number), each of which only requiresmsg.value >= tokenPrice(ortokenPrice.mul(number)); the ETH is held by the contract and nothing in the code forwards it to any treasury, escrow or refund mechanism. - The owner can pull all of it at any time with
withdraw():(bool os, ) = payable(owner()).call{ value: address(this).balance }("");. The owner can also change the price (setPrice), switch the sale off (toggleSaleState), swap the metadata base URI (setBaseURI) and mint without payment (mint3(address receiver, uint256 numberOfTokens)), andrenounceOwnership()was never needed to keep these powers. - The deployer's internal-transactions page shows transfers from the contract to the deployer address on 2022-03-13, 2022-03-14 and 2022-03-18, which fits repeated withdrawals of the mint proceeds; De.Fi's listing describes this as the deployer withdrawing all deposited ETH.
Protocol details
Evidence
- transaction Etherscan internal transactions for deployer 0x5cad06E17452179ABe3ee7F99CE649d16d059616 etherscan.io
- address Etherscan verified source: NFTflow Membership Pass 0x253954d29386e174Ed4BC69902391a8ED3fd51ca etherscan.io
- analysis De.Fi REKT database listing for NFTflow (as imported in meta.json) nftflowmint.gw.to
- analysis Web Archive web.archive.org
- analysis Sourcify repository: NFTflow Membership Pass 0x253954d29386e174Ed4BC69902391a8ED3fd51ca repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
