DiceSwap Hack

The Master Chef contract contains hidden functionality under the set() function, which was invoked multiple times by the contract deployer at:

https://explorer.bitquery.io/bsc/txs/calls?internal=false&contract=0x08eee9c8…c21370&method=d9638422

Calling set() function led to the LP tokens and native tokens transfer onto the external wallet, example transaction:

https://bscscan.com/tx/0x6a16dd9f…3ecbf6

The liquidity was removed by the external wallet multiple times at:

https://bscscan.com/tx/0xb523ea3c…3065a4

https://bscscan.com/tx/0x3f6d3d3e…5cf0eb

https://bscscan.com/tx/0x751d3f47…3d5a12

https://bscscan.com/tx/0x3197c878…808af3

https://bscscan.com/tx/0x83d93a52…0c03a1

https://bscscan.com/tx/0x89b3c2fc…4fec5f

https://bscscan.com/tx/0x7880e9c3…603ff3

https://bscscan.com/tx/0xf25a25c7…d1a285

https://bscscan.com/tx/0x6a2ac8d4…f09385