Convergence Protocol Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

This "Convergence Protocol" (CONV) token on Ethereum is a separate contract from the Convergence Finance CONV token, and its transfer code lets almost no one except the owner's chosen addresses sell. Every transfer and transferFrom runs the burnTokenCheck modifier. While a hidden _sellAmount is 0, as it is at deployment, an ordinary holder's transfer only goes through if the recipient is the owner or the Uniswap V2 router, which never happens in a Uniswap sell, so selling reverts with the misleading message "ERC20: transfer amount exceeds balance".

The owner can open a small window by raising _sellAmount: sells below it succeed once and then put the seller on a blacklist. The owner-only whitelist, blacklist and _safeOwner setters are disguised under ERC-20 names (increaseAllowance, addApprove, decreaseAllowance), and _mint is a public function the owner can call to mint without limit. De.Fi's REKT database lists this token as a honeypot.

How it happened

  1. The constructor sets _owner and _safeOwner to an address passed in at deployment and mints the initial supply to it; the on-chain total supply is 10,000,000,000 CONV. The contract has no function to change or renounce _owner.
  2. While _owner == _safeOwner, the owner's first outgoing transfer sets _safeOwner to its recipient. If that transfer is the liquidity add, the Uniswap pair becomes _safeOwner, and every transfer from it (every buy) is allowed.
  3. A holder who is neither whitelisted nor blacklisted can only transfer when amount < _sellAmount, or when the recipient is the owner or the router 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D. _sellAmount starts at 0, and a Uniswap sell sends tokens to the pair, not the router, so the sell reverts.
  4. The owner sets _sellAmount by transferring tokens to itself. A holder who then sells less than _sellAmount to _safeOwner succeeds, but the same call sets _blackAddress[sender] = true, so every later sell by that holder reverts.
  5. Addresses the owner adds with increaseAllowance(address[]) or multiTransfer are whitelisted and can transfer freely, addApprove(address[]) blacklists addresses, and decreaseAllowance(address) can re-point _safeOwner to any address.

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Honeypot
Affected asset / contract CONV

Evidence

Same attack technique

Browse all hacks →
BNB Chain HighQuality Swap Loss not disclosed BNB Chain SafeDelore3n Loss not disclosed BNB Chain SafeCow Loss not disclosed BNB Chain MetaChain Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes