When ONTR's creator renounced ownership to signal trustworthiness, the onlyOwner modifier contained a flawed require statement that treated owner == address(0) as permission rather than denial. This turned the ownership renunciation into a backdoor, allowing anyone to reclaim ownership and drain the contract of $98.2K in funds within minutes.

The ONTR token project was drained due to a flawed onlyOwner check in the contract (accepts owner == address(0)). This allowed re-owning a renounced token. The attacker used hidden balance-grant logic to fake massive ONTR balances (no totalSupply/mint logs), dumped into the ONTR/WETH LP, and swapped out WETH for profit.