What happened
NIFITY (nifity.io, contract 0x44436DAD…38E1e7) is a plain Ethereum ERC-20 with no transfer restrictions, fees or sell blocks; the loss came from the liquidity pool, not from a trap in the token. On 2021-01-13 the contract deployer 0x71A991cc…0132C0 created the NIFITY/USDT Uniswap V2 pair with 666,666 NIFITY and 100,000 USDT (tx 0x86d2f28d…0e0c6b), and the 0.258198761 LP tokens were returned to that address. On 2021-01-22 at 23:52:53 UTC the same address called removeLiquidityWithPermit (tx 0xd7f69999…73170d), burned all 0.258198761 LP tokens and received 352,496.45 NIFITY and 194,064.51 USDT.
De.Fi lists the loss as 93,410 USD, which is close to the USDT received minus the 100,000 USDT originally added. The contract also gives its owner an uncapped mint and an allowance-free burn of any holder's balance; no transaction opened here shows either being used.
How it happened
- The token is a stock ERC-20 whose only privileged functions are
mintandburn:function mint(address _to, uint256 _amount) public onlyOwnerandfunction burn(address account, uint256 amount) public onlyOwner. Nothing in it restricts who can sell or transfer. - The deployer paired NIFITY with USDT on Uniswap V2 on 2021-01-13 and received the LP tokens, as the Etherscan page for the
addLiquiditytransaction shows (0.258198761 UNI-V2 returned to the sender). - The token contract has no function that locks or escrows LP tokens, so the LP holder could withdraw the pool at any time.
- Nine days later the deployer address called
removeLiquidityWithPermit, burned all 0.258198761 LP tokens and received 194,064.51 USDT and 352,496.45 NIFITY, which is roughly 94,000 USDT more than it deposited. Holders who had bought NIFITY with USDT were left with a token whose pool was gone. - Separately,
minthas no cap andburnneeds no allowance, so the owner could also inflate the supply or burn tokens from any address, including the pool; the code does not show whether this happened.
Protocol details
Evidence
- report Report nifity.io
- transaction Etherscan transaction 0x86d2f28d... (Uniswap V2 addLiquidity) etherscan.io
- transaction Etherscan transaction 0xd7f69999... (Uniswap V2 removeLiquidityWithPermit) etherscan.io
- address Etherscan verified source for NIFITY (nifity.io) etherscan.io
- analysis Sourcify repository entry for NIFITY repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
