crocofi.org(CROCO) Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

crocofi.org (CROCO) is a BNB Chain token deployed on 13 April 2021 at 0x152ce3dd…03f169. Its transferFrom only works for holders marked in an allow mapping, and at deployment only the deployer is marked, so the PancakeSwap router cannot pull an ordinary holder's tokens and a normal sale reverts while buys, which use plain transfer from the pair, still go through. The functions that manage that list and a mint function that overwrites any address's balance are gated by a hard-coded address, 0xbd486897…439192, not by the stored owner, so transferOwnership cannot hand these powers away.

De.Fi's REKT database lists CROCO as an exit scam/rug pull; no loss figure was found.

How it happened

  1. The constructor credits the whole supply to the deployer and sets allow[msg.sender] = true; no other address starts on the list.
  2. transfer has no restriction, so tokens sent out of the PancakeSwap pair reach buyers normally.
  3. transferFrom adds require(allow[_from] == true);. A router sale calls transferFrom on the seller's tokens, so for any holder not on the list the sale reverts even with a valid approval.
  4. onlyOwner checks msg.sender == address(1080614020421183795110940285280029773222128095634), which is 0xbd486897…439192. That address can call addAllow(holder, bool) to let chosen wallets sell or to remove them from the list.
  5. The same address can call mint(miner, _value), which runs balances[miner] = _value: it can give any wallet an arbitrary balance to sell into the pool, or set any holder's balance to zero, without changing totalSupply.
  6. transferOwnership only rewrites the owner variable, which onlyOwner never reads, so neither power can be transferred or renounced.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract CROCO
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Original.finance Loss not disclosed BNB Chain MYSTERYToken Loss not disclosed BNB Chain Vine Protocol Loss not disclosed BNB Chain Mortal Kombat Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes