CHRONOSFINANCE Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

CHRONOSFINANCE (CHRONOS) is a BNB Smart Chain token contract deployed on 2021-06-02 by 0x1feAb2A0…09856D in transaction 0x2b2f6cbe…331b22. De.Fi's REKT database lists it as an Exit Scam/Honeypot, noting that the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source is a fee-on-transfer reflection token whose private _transfer contains one extra check, require(tx.origin == to || tx.origin == owner());.

Because a sale sends tokens to the liquidity pair, the transaction sender is the seller and the recipient is the pair, so the check fails for ordinary holders, while transactions sent by the owner pass.

How it happened

  1. The constructor gives the full supply (_tTotal = 1000 * 10**6 * 10**9, 9 decimals) to the deployer, creates a pair for the token through the router address hard-coded in the constructor, and exempts the owner from fees.
  2. transfer and transferFrom both end in the private _transfer, which includes require(tx.origin == to || tx.origin == owner()); (no revert message).
  3. A buy sends tokens from the pair to the buyer. It passes only when the buyer's own wallet both sent the transaction and receives the tokens (tx.origin == to).
  4. A sale makes the router call transferFrom(holder, pair, amount). Here to is the pair and tx.origin is the holder, so neither side of the require holds and the sale reverts. A plain transfer to a different wallet fails the same way unless the recipient or the owner sent the transaction.
  5. A transaction whose origin is owner() always passes this check, so the owner can sell, add liquidity or move tokens freely.
  6. Further owner controls exist: setTaxFeePercent and setliquidityFeePercent accept any value with no cap, and setSwapAndLiquifyEnabled(false) together with setMaxTxPercent(0) would make the _maxTxAmount check (if(from != owner() && to != owner() && !swapAndLiquifyEnabled) require(amount <= _maxTxAmount)) reject every non-owner transfer, because _transfer also requires amount > 0. The on-chain owner read at the latest block on 2026-09-30 is still the deployer address.
  7. What the code allows is separate from what happened: De.Fi's REKT database lists the token as a honeypot, but no transaction showing a failed sale or the owner using these functions was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract CHRONOS

Evidence

Same attack technique

Browse all hacks →
BNB Chain HolderFinance Loss not disclosed Ethereum SunDoge Inu Loss not disclosed BNB Chain TacoSwap Loss not disclosed BNB Chain NFTD Protocol Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes