What happened
WhiteNova (WNOVA) is a BEP-20 token whose transfer and transferFrom both revert when the recipient equals an owner-settable address called newun. The first transferFrom call made while newun is unset records that call's recipient as newun, and the owner can later repoint it with transfernewun. If the recipient recorded this way is a liquidity pair, every holder sale to it fails with "please wait" and the holder keeps the balance but cannot sell it.
De.Fi's REKT database lists WNOVA as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling their tokens.
How it happened
- The deployer receives the whole supply in the constructor:
balances[owner] = _totalSupply;(1,000,000 WNOVA at 6 decimals). transferFromrecords the first recipient it sees:if(from != address(0) && newun == address(0)) newun = to;. When the first such call is a router moving tokens into a liquidity pair, that pair becomesnewun; the code does not show which call came first on chain.- After
newunis set,transferFromtakes the other branch:else require(to != newun, "please wait");, andtransferhasrequire(to != newun, "please wait");. A router sale callstransferFromwith the pair asto, so it reverts whenever the pair equalsnewun. There is no exemption for the owner either. - The owner can change the target at any time:
function transfernewun(address _newun) public onlyOwner { newun = _newun; }. Pointing it at an unused address lifts the block; setting it to the zero address re-arms the capture, so the nexttransferFromrecipient becomesnewun. - The owner can also pull any BNB held by the token contract:
function clearCNDAO() public onlyOwner() { ... _owner.transfer(address(this).balance); }.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
