NFTLogy Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

NFTLogy (NTLG) is a BEP20 token whose BeforeTransfer modifier stores the recipient of the first transferFrom in nxOwner and then reverts any later transfer to that address unless the sender is _owner. If the stored address is a trading pair, ordinary holders cannot sell into it, while the owner address is exempt. The function named transferOwnership only overwrites nxOwner, so the owner can move or clear the blocked address.

De.Fi's REKT database lists the token as an Exit Scam/Honeypot and says the contract owner could restrict users from selling. An opened Token Sniffer post from 2021-05-05 describes this kind of LP-address block in other tokens and predates this deployment.

How it happened

  1. The constructor mints 1 * 10**12 * 10**9 raw units to the deployer, who becomes _owner and _leaveowner.
  2. transfer calls _transfer(..., false) and transferFrom calls _transfer(..., true). Both run the modifier BeforeTransfer(from, to, fromTransfer).
  3. The modifier runs if(from != address(0) && nxOwner == address(0) && fromTransfer) nxOwner = to; else require((to != nxOwner || from == _owner), "Order TransferFromMiddleware");. The first transferFrom while nxOwner is empty stores its recipient in nxOwner. The source does not show which address that was.
  4. After that, any transfer or transferFrom whose recipient is nxOwner reverts unless from == _owner. If nxOwner is a pair, a sell is a router transferFrom(holder, pair, amount) and reverts for every holder other than _owner, and the holder's balance is not debited. Buys, where the pair is the sender, are not blocked by this check.
  5. transferOwnership(address newOwner) public onlyOwner does not change the owner; it runs nxOwner = newOwner;. Pointing it at an unused address lifts the block, and setting it to the zero address re-arms the capture for the next transferFrom.
  6. renounceOwnership sets _owner = address(0), but onlyOwner also accepts _leaveowner, which the function leaves unchanged, so onlyOwner calls such as transferOwnership remain available to that address.
  7. What happened on-chain (which address nxOwner held, sell attempts, liquidity removal, losses) was not established by the opened sources. De.Fi's REKT database lists the token as a honeypot.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NTLG

Evidence

Same attack technique

Browse all hacks →
BNB Chain GUCCI Loss not disclosed Ethereum Moony Farm Loss not disclosed BNB Chain NeptuneWallet Loss not disclosed Ethereum Wu-Tang Financial Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes