CROT Finance Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

De.Fi's REKT database lists Crot Finance ($Crot) on BNB Smart Chain as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The code implements a block on transfers to one stored address, newun. The first transferFrom call made while newun is empty stores its destination as newun, and every later transferFrom or transfer to that address reverts with "please wait".

If that first destination is the liquidity pair, token sales through the pair stop working while purchases from it still go through. The owner can also change newun at any time with transfernewun. The code does not show which address newun ended up holding.

How it happened

  1. The constructor mints the whole supply of 100000000000000000 raw units (9 decimals) to the deployer, who becomes owner. newun starts as the zero address.
  2. transfer rejects any transfer to the stored address: require(to != newun, "please wait");.
  3. transferFrom begins with if(from != address(0) && newun == address(0)) newun = to; else require(to != newun, "please wait");. The first transferFrom made while newun is empty is not checked and writes its recipient into newun. In a normal listing, the first transferFrom is the router pulling tokens into the pair when liquidity is added, so the pair would become newun; the code does not show which address it actually became.
  4. From then on, any holder whose sell calls transferFrom with that address as recipient reverts with "please wait", and so does a direct transfer to it. A transfer out of that address, such as a purchase, is not blocked. The block applies to every sender, including the owner, until newun is changed.
  5. transfernewun(address _newun) is onlyOwner and overwrites newun. Setting it to the zero address lets the next transferFrom capture a new destination; pointing it at an address that is not used lifts the block.
  6. What happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot. A write-up of this pattern (a stored address that transferFrom refuses to send to, "please wait") explains it as a way to stop sells while allowing buys, but it does not mention this token. No transaction was opened for this contract, so the code evidence does not show the value newun held or any liquidity removal.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract $Crot

Evidence

Same attack technique

Browse all hacks →
BNB Chain SaveFlipper Loss not disclosed BNB Chain Torio Loss not disclosed BNB Chain NOZOMI COIN Loss not disclosed BNB Chain HellGate Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes