What happened
NovaMind (NMD) was an ERC20 token on Ethereum, contract 0x9cb6dd25…d87a4a, deployed on 24 April 2024 with 100,000,000 NMD minted to the deployer. Its code gives the owner a blacklist that blocks a transfer when the sender, the calling contract or the wallet that signed the transaction is listed, so the owner can freeze any holder or halt trading through the Uniswap router. enableTrading also sends the Uniswap LP tokens to the owner rather than locking them.
Buy and sell fees are capped at 20%, but a 40% voidMind tax hits wallets that bought in the first 24 blocks when they sell, and spreads to wallets they transfer to. On 2 May 2024 CertiK confirmed NovaMind as an exit scam: about 41 ETH (about $123,000) went to a multisig likely used as the presale address, the project's social accounts were deleted and the token fell about 97%. The earlier write-up adds that the deployer dumped NMD on Uniswap for 23.52 ETH (about $70,057) in transaction 0x39be1bd4…173a0f and bridged the ETH to 0x81746420…6cE34d on Base.
How it happened
- The constructor mints all 100,000,000 NMD to the deployer and exempts the deployer from fees and the wallet cap.
enableTradingcreates the Uniswap pair and adds liquidity withrouter.addLiquidityETH{value: address(this).balance}(address(this), balanceOf(address(this)), 0, 0, msg.sender, block.timestamp);, so the owner receives the LP tokens and can remove the liquidity.- Every transfer runs
require(!isBlacklisted[from] && !isBlacklisted[msg.sender] && !isBlacklisted[tx.origin], "NMD: blacklisted");, and the owner can set any address withblacklist(address[] calldata accounts, bool value). Listing a holder freezes that holder's tokens; listing the router or the pair would block every sell or buy made through them. - Buyers in the first 24 blocks get
voidMindAt[to]set, and their later sells payvoidMindFees = 40percent instead of the normal sell fee. - According to CertiK, about 41 ETH of presale funds went to a multisig, socials were deleted and the price fell about 97%; the earlier write-up says the deployer sold NMD for 23.52 ETH and bridged it to Base. No source shows the blacklist or the LP tokens being used.
Protocol details
Evidence
- report CertiK Insight: NovaMind is an exit scam twitter.com
- transaction NMD token creation transaction etherscan.io
- transaction etherscan.io transaction 0x39be…3a0f etherscan.io
- address NovaMind (NMD) verified source code etherscan.io
- address basescan.org address 0x8174…E34d basescan.org
- address etherscan.io address 0x96c5…c915 etherscan.io
- analysis Sourcify exact match for 0x9cb6dd255a6bbe32130ce645ec45c0a3e9d87a4a on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
