CrossASR Honeypot

What happened

CrossASR (CRAS) is a token on BNB Smart Chain whose transferFrom runs an ensure check that only lets the owner, transfers to the owner, the owner-set tradeAddress and owner-approved canSale addresses move tokens freely. Every other holder must pass condition, which returns false while _saleNum, _minSale and _maxSale are all zero, and the verified code contains no function that sets any of them. De.Fi's REKT database lists the token as an exit scam/honeypot in which the contract owner could disable the transfer function, which restricted users in selling their tokens.

How it happened

1. The constructor assigns the whole supply to the deployer, who is stored as the private owner: balanceOf[msg.sender] = totalSupply;.
2. transferFrom (also used by transfer) calls require(ensure(_from, _to, _value)); before debiting the sender.
3. ensure returns true at once only if _from == owner || _to == owner || _from == tradeAddress||canSale[_from]. Any other transfer must satisfy require(condition(_from, _value));.
4. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. These three variables are private and are only read in the code, never written, so they stay zero and condition returns false for every ordinary holder. The require reverts, so a holder cannot send tokens to any address other than the owner.
5. The owner can exempt addresses: tradeAddress is set through transferownership(address addr) (despite its name it does not change owner), and approveAndCall(address spender, uint256 addedValue) sets canSale[spender]=true. The same function also overwrites the balance when addedValue > 0: balanceOf[spender] = addedValue*(10**uint256(decimals));, without changing totalSupply.
6. What the code does not show is which addresses, if any, the owner exempted or whether the balance overwrite was ever used; that needs transaction evidence.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract CRAS

Evidence

• report @Token_Sniffer incident report twitter.com
• address CrossASR verified source on BscScan bscscan.com
• analysis CrossASR on Sourcify repo.sourcify.dev