What happened
The contract owner invoked setMigrator() function at:
https://etherscan.io/tx/0xf73a10ee…9007f1
CoinSWOPMaster smart contract was set as migrator. The smart contract owner called migrate() functions 11 times to withdraw the user's LP tokens with the help of infinite approval. LP tokens were migrated to an unverified smart contract that received real LP tokens and returned fake ones. Then real LP tokens went to the contract deployer as the final recipient. Migrate transaction example:
https://etherscan.io/tx/0x5b19f1e3…48c592
The final recipient is getting LP tokens:
https://etherscan.io/tx/0xe6543f5b…3c5aea
LP tokens were exchanged for ETH and deposited to the Tornado Cash mixer at these transactions:
https://etherscan.io/tx/0xd6584b95…f8578c
https://etherscan.io/tx/0x90bd78b4…05b47c
https://etherscan.io/tx/0x5d530f23…08667d
6.8 ETH were transferred to some external wallet:
https://etherscan.io/tx/0xf8759517…b48867
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.