What happened
CHOC (ChocolateToken) on BNB Smart Chain is a governance-style token whose only privileged supply control is mint(address _to, uint256 _amount) public onlyOwner. That function calls _mint with no cap, so whichever account holds the owner role can create new CHOC at any time and dilute every other holder. An on-chain read on 2026-09-30 returns 0x79c725a1…2f9632 as owner(), the same address the De.Fi proof link is filtered on.
De.Fi's REKT database lists the token as an Exit Scam/Rugpull dated 2021-09-30; the proof page could not be retrieved, so the specific mint, sale or liquidity transactions are not established here.
How it happened
What the code allows (the transactions that actually happened are not verified):
- The deployer of
ChocolateTokenbecomes_ownerthroughOwnable, and the owner role can be moved withtransferOwnership(address newOwner)or dropped withrenounceOwnership(). mintis gated only by the owner role and has no cap or schedule:function mint(address _to, uint256 _amount) public onlyOwner { _mint(_to, _amount);._mintraises supply and the recipient balance directly:_totalSupply = _totalSupply.add(amount); _balances[account] = _balances[account].add(amount);. Every existing holder's share of supply falls by the minted amount.- Transfers carry no restriction:
_transferonly runs_balances[sender] = _balances[sender].sub(amount, ...)and credits the recipient, so freshly minted tokens can be sent straight to a trading pair.
De.Fi's REKT database lists the token as an Exit Scam/Rugpull dated 2021-09-30. No transaction was opened, so this page does not state that a mint or sale occurred.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
