shadownite.com Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

shadownite.com (NITE) is a BNB Chain token deployed on 20 February 2021 at 0x6a887414…4ca249, advertised in its source comments as the governance token of an NFT market. Its transfer and transferFrom only let tokens move when the sender is the owner, the owner-set tradeAddress, or an address the owner has marked in canSale, or when the recipient is the owner. Every other sender must pass a condition check that returns false while three sale limits are all zero, and the contract has no function that ever sets them, so an ordinary holder's sale reverts from the moment of deployment.

The owner can also overwrite any address's balance with an arbitrary amount through a function named approveAndCall. De.Fi's REKT database lists NITE as an exit scam/honeypot, stating that the contract owner could disable transfers and so stop holders from selling.

How it happened

  1. The constructor stores the deployer in a private owner variable and credits it with the full 1,000,000 NITE supply. No function changes or renounces owner.
  2. The owner can call the misnamed transferownership(addr), which does not transfer ownership but sets tradeAddress. Tokens sent from tradeAddress always pass, so if it is the PancakeSwap pair, purchases paid out by the pair succeed.
  3. For any other sender, ensure requires condition(_from, _value) unless the recipient is owner. condition returns false when _saleNum, _minSale and _maxSale are all zero, and no function in the contract writes to them.
  4. A sale moves tokens from the holder to the pair with transferFrom(holder, pair, amount), so the holder is the sender and the call reverts. Only the owner, tradeAddress and canSale addresses can send tokens to anyone other than the owner.
  5. The owner can call approveAndCall(spender, addedValue) to set balanceOf[spender] to addedValue whole tokens, without updating totalSupply or emitting an event, and to add that address to canSale so it can sell.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract NITE

Evidence

Same attack technique

Browse all hacks →
BNB Chain SexySwap Loss not disclosed BNB Chain RapidSwap Loss not disclosed Ethereum DARK DEFI $27K lost Ethereum Xend.finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes