CrossPad Honeypot

Reported loss Not disclosed
Ethereum
Honeypot

What happened

CrossPad (CROSS) is an Ethereum token deployed on 1 May 2021 at 0xf200c3b8…8f85af. Every transfer and transferFrom passes through a burnTokenCheck modifier that lets through the owner, a second privileged address called _safeOwner, and owner-whitelisted wallets, but requires every other sender to be _safeOwner or to send to the Uniswap V2 router address. A sale moves tokens from the holder to the Uniswap pair, not to the router, so it reverts with a disguised "ERC20: transfer amount exceeds balance" error.

The owner controls the whitelist, a blacklist and _safeOwner through functions named after standard ERC-20 allowance calls, and _mint is public but owner-only, adding any amount to the owner's balance. De.Fi's REKT database lists CrossPad as an exit scam/honeypot, stating that the contract owner could disable the transfer function and so stop users from selling.

How it happened

  1. The constructor sets _owner and _safeOwner to the owner argument and mints the initial supply to it. The contract has no function that changes _owner, so the owner role can never be renounced.
  2. burnTokenCheck lets a transfer through if the sender is _owner or _safeOwner, if the recipient is _owner, or if the sender is on _whiteAddress. While _owner == _safeOwner, the owner's first outgoing transfer also moves _safeOwner to that transfer's recipient.
  3. Any other sender hits require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance") unless the amount is below _sellAmount. _sellAmount starts at 0, so no amount qualifies, and a sale to the pair reverts.
  4. The owner can raise _sellAmount by transferring tokens to itself. Transfers below that amount then pass, but a transfer to _safeOwner also puts the sender on _blackAddress, after which only the _safeOwner/router condition applies.
  5. The owner can whitelist wallets with increaseAllowance(address[]), blacklist them with addApprove(address[]), reassign _safeOwner with decreaseAllowance(address), and whitelist airdrop recipients while setting their router allowance to the maximum with multiTransfer.
  6. _mint(account, amount) is public but owner-only; it always credits _balances[_owner] while the Transfer event names account as the recipient.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract CROSS

Evidence

Same attack technique

Browse all hacks →
BNB Chain Dojecoin Loss not disclosed Ethereum NFTify.Network Loss not disclosed Ethereum makiswap.com Loss not disclosed Ethereum Bring.finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes