Kron, a decentralised exchange and token launchpad built directly on Kaspa’s base layer, has completed a security audit with Web3 security firm Hashlock. The review, finalised in September 2026, covered the four covenants that run Kron’s bonding curve, order settlement, AMM pool, and token transfers. All four received a “Secure” rating, with every finding resolved or acknowledged.
What Is Kron?
Kron is a Kaspa DEX and launchpad. Anyone can launch a token on a bonding curve, trade it, and once the curve graduates, trade it on an AMM pool with permanently locked liquidity. Trades are built and signed in the user’s browser, so the platform never takes custody.
All of it runs on Kaspa L1 through covenants, the programmable spending conditions activated by the Toccata hard fork at the end of June. There is no separate chain and no bridge. Kron launched on 25 July, less than a month after the feature it depends on went live.
Why the Architecture Matters
Under the KRC-20 model, token instructions ride inside ordinary Kaspa transactions and an offchain indexer reads them to work out balances. Kaspa validates the transaction and the indexer decides what it means. The 20 September exploit found the gap between those two systems: a malformed script that Kaspa accepted as valid and the indexer read as a real transfer. The vulnerability was in the Kasplex indexer, large quantities of ZEAL and NACHO were moved out of a bridge wallet, and Igra Labs’ L2 was affected downstream.
Kron’s tokens use the KCC-20 pattern. Transfer rules sit inside the covenant, so a token can only move by satisfying conditions that Kaspa nodes check as part of consensus. There is no second system to fool, which puts all the weight on the covenant being right.
Audit Scope
Hashlock reviewed the four covenants through manual, line by line analysis. The first runs the bonding curve, covering launch, buys, sells, graduation to the AMM, and batched settlement of pre-funded orders. The second is the escrow that holds those orders while they wait. The third is the post-graduation pool, with swaps, liquidity, and a one-time step that mints the LP token at a fixed supply so it can never be minted again. The fourth is the token itself, with a single transfer entry point.
Every entrypoint was checked against its intended behaviour and confirmed to match. The covenants have no privileged roles, so every function is permissionless.
Because the covenants were compiled with a pre-1.0 version of the SilverScript compiler, and no static analysis or fuzzing tools existed for the language at the time, Hashlock also went one level below the source and checked targeted parts of the compiled script directly. The build reproduces byte for byte, dispatch order matches the source, and the guards that protect token supply and liquidity are present in the emitted bytes. This is the kind of check that catches a gap between what a script says and what actually executes. The KRC-20 exploit came from a gap of that kind.
Findings and Resolution
The audit identified one medium severity issue, thirteen low, and ten QA items. Twenty are resolved and four acknowledged.
The medium finding was in batched settlement. Covenant-owned token balances carry a small amount of KAS to stay alive onchain, and the other entrypoints protect that amount with a relative check. The batched path pinned it to a fixed constant instead, so any excess would have leaked to the miner fee on each batch. The fix brought it in line with the rest of the covenant. The low and QA findings covered output ownership constraints, an unbounded index in token transfer, a missing deadline on orders, and builder-side validation.
After remediation, Hashlock rated the covenants “Secure”, noting that the code is clearly commented and consistently styled. The report is also direct about its limits: the covenants were compiled with a pre-1.0 compiler, the covenant opcodes went live weeks before the review, and tokens deployed under earlier schemas were outside scope. Kron’s existing tokens stay on the audited compiler version, and any future covenant changes will be independently re-audited.
Resources
Hashlock audit page: https://hashlock.com/audits/kron
Kron: https://kron.technology/
Kron audit page: https://kron.technology/audit
About Hashlock
Hashlock is a leading Web3 security firm specialising in smart contract auditing and blockchain cybersecurity. Hashlock has conducted 200+ audits and helped secure over $1.3 billion in onchain value across DeFi, gaming, infrastructure, and enterprise blockchain systems.
Website: https://hashlock.com/
About Kron
Kron is a Kaspa DEX and token launchpad running entirely on Kaspa L1 through native covenants. Users can launch tokens on a bonding curve, trade them, and provide liquidity on a permanently locked AMM. All transactions are built and signed in the browser. Kron launched on 25 July 2026.
Website: https://kron.technology/
