Nova Honeypot

What happened

Nova (NOVA) was a BNB Chain token whose approve only worked for one hard-coded wallet, the deployer 0x265F4ec7…C050B1. For every other holder, _approve stores an allowance of 0 while emitting an Approval event that shows a value of 2. Selling through the PancakeSwap router needs transferFrom, which requires an allowance, so holders who bought could not sell that way, while the deployer could.

De.Fi's REKT database lists NOVA as an exit scam/honeypot; no transaction data or loss figure for this token was found.

How it happened

1. _approve checks the token owner against a fixed address: if (owner == address(0x265F4ec761D934C5222122f93C10f3FdECC050B1)) { _allowances[owner][spender] = amount;. Only that wallet gets a real allowance.
2. Every other wallet falls into the else branch: _allowances[owner][spender] = 0; emit Approval(owner, spender, 2);. The approval transaction succeeds, so the wallet looks approved, but the stored allowance stays 0.
3. A router sell calls transferFrom, which ends with _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"). With a 0 allowance this reverts, so the sale fails. Plain transfer between wallets still works, and buys work because the pair sends tokens with transfer.
4. The deployer's approvals are stored normally, so that wallet can sell into the same pool.
5. The owner can also create new tokens at will: function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount);. There is no supply cap. renounceOwnership exists and would disable mint, but the approval check is tied to a hard-coded address, not to ownership, so renouncing would not lift the sell block. As of 2026-09-30 owner() still returns the deployer.

Protocol details

Classification Exchange (DEX)

Protocol Type Telegram Bot

Affected asset / contract NOVA

Protocol links Website @TradeonNova

Evidence

• report @Token_Sniffer incident report twitter.com
• address Nova (NOVA) BEP20Token contract source, BscScan verified code bscscan.com
• analysis Sourcify repository: chain 56, 0x62dbbb0b727829357fce38bddec79cbeae819f4e (BEP20Token.sol) repo.sourcify.dev
• analysis BSC-SCAM: PancakeSwap NoApproval (cryptot3ddybear blog) cryptot3ddybear.gitlab.io