Oportunity Token Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

Oportunity Token (OPRTNTY) is an ERC-20 whose transfer and transferFrom both refuse any recipient equal to a variable called newun. The newun variable is filled either by the owner through transfernewun or automatically, with the recipient of the first transferFrom made while it is unset. Tokens can still leave the newun address but cannot be sent back to it.

The source header comment says "NO DEVS, NO OWNER", while the code contains an Owned contract and owner-only functions. De.Fi's REKT database lists the token as an exit scam/honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens. No opened source shows what newun was set to or what happened to holders.

How it happened

  1. The constructor sends the whole supply to the deployer: balances[owner] = _totalSupply;. The deployer is also owner and the only caller of the owner-only functions, despite the header comment "NO DEVS, NO OWNER".
  2. transfernewun(address _newun) public onlyOwner sets newun, and transfer starts with require(to != newun, "please wait");, so no direct transfer can send tokens to that address.
  3. transferFrom begins if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom with a non-zero from while newun is unset succeeds and stores its recipient as newun. Every later transferFrom to that recipient reverts before balances[from] is reduced, so the sender keeps their tokens.
  4. Nothing checks from against newun, so transfers out of that address are not blocked by this code. Which address newun ends up as depends on the first transferFrom or on the owner; the code does not name it.
  5. The block can be lifted only by the owner pointing newun at an address nobody sends to. Setting it back to the zero address re-arms the automatic capture, because the next transferFrom writes a new recipient into it. Owned also allows transferOwnership/acceptOwnership, and nothing in the file renounces ownership.
  6. The opened write-up (dated 2021-04-11) describes this same code in other BNB Smart Chain tokens, where newun was the PancakeSwap pool set on the first add-liquidity call, so buys worked and sells back to the pool reverted. It does not cover this token, and no transaction for it was opened; the listing for this record comes from De.Fi's REKT database.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract OPRTNTY

Evidence

Same attack technique

Browse all hacks →
BNB Chain Umbrella Loss not disclosed Ethereum London X Protocol Loss not disclosed BNB Chain SUPERCYCLE Loss not disclosed Ethereum SolstarterToken Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes