What happened
The contract owner invoked setMigrator() function at:
CoinSWOPMaster smart contract was set as migrator. The smart contract owner called migrate() functions 11 times to withdraw the user's LP tokens with the help of infinite approval. LP tokens were migrated to an unverified smart contract that received real LP tokens and returned fake ones. Then real LP tokens went to the contract deployer as the final recipient. Migrate transaction example:
The final recipient is getting LP tokens:
LP tokens were exchanged for ETH and deposited to the Tornado Cash mixer at these transactions:
6.8 ETH were transferred to some external wallet:
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
