Is Cromon Quest safe and legit?

What does the game ask my wallet for?

A signature, and nothing else, to log in. Your wallet shows you the exact text you are signing: it names the site, carries a timestamp, and is rejected by our server if it is older than five minutes, so a captured signature cannot be replayed later. A signature is not a transaction: it costs no gas, it cannot move a token, and it grants no spending permission. If a page claiming to be Cromon Quest ever asks you to sign something you do not understand, or to approve a token spend just to log in, it is not us.

Transactions happen only where you expect them: opening a Rift on the mint page, listing or buying on the marketplace, and forging at the Fusion Forge. Each one is a single, explicit wallet prompt with the amount visible.

Who holds my Cromons?

You do. A minted Cromon is an ERC-721 token delivered to your address by the contract itself; the game reads the chain to know what you own, it does not hold anything for you. The three starters are the one exception, and they are the opposite of a risk: they are off-chain grants, non-tradeable, and worth nothing to a thief. When you list a Cromon for sale, the marketplace contract holds it in escrow until it sells or you cancel, and cancelling is never blocked, even when the rest of the marketplace is paused.

Can the mint be rigged?

Not by us, and not by you. Your mint transaction commits first, sealing an outcome nobody can read yet. The reveal happens at least 5 Cronos blocks later (about 30 seconds) and derives species, rarity and stats from a block hash that did not exist when you committed. There is no way to peek at the result before it is locked and no way to retry a roll you dislike. If a reveal somehow never lands, the contract lets you refund the mint. The minting guide walks through the two steps, and the odds per tier are published on the mint page from the same values the contract uses.

Where is the money when I trade?

Not in our hands. On a sale, the buyer's CRO goes straight to the seller in the same transaction that moves the NFT; the contract keeps only the 5% buyer fee and the 2% penalty a seller pays for cancelling within 72 hours. Those fees are the only balance the operator can withdraw. The principal of a listing never enters the contract's balance, so there is nothing to run away with, and the code that says so is public.

How do I verify any of this?

Read the contracts. Both are deployed on Cronos and readable on the explorer; the NFT contract has its source verified there, which means the explorer shows the exact code that runs, not a description of it:

• Cromon NFT (ERC-721): 0xa55b4930A6524e87084490920f913bB469B32559 · explorer
• Marketplace (escrow): 0x13e022cE29336fCDa5B94B95E8b6DEcaA5752523 · explorer

Then check the people. The team is reachable on the official Discord and on X, the press kit names the brand and the contract in plain text, the changelog is a dated record of every release, and the game is listed by third parties such as PlayToEarn and the Crovia marketplace on Cronos. A project that hides any of those is the one to worry about.

What should I still be careful about?

The same things as anywhere in Web3. Type the address, quest.cromon.fun, rather than following a link in a DM: an impostor site can copy our design but cannot sign as our contracts. Keep the wallet you play with separate from the one that holds your savings, which is good practice for every game. And treat any offer of "free Cromons" that arrives by private message as what it is: the real free mints are announced in the public Discord channels, and the three starters, Kindlekin, Pladdle and Sproutara, are granted by the game itself and never require you to send anything to anyone.