What happened
The attacker:
https://bscscan.com/address/0xfd544b21…fd0921, as was stated by the project team in the tweet:
https://archive.is/4MRMN
tokenMigrate() function was called by the address which probably was saved to MasterChef in the constructor() initialization into private variable migrateAddress. Since the caller of the tokenMigrate() function was address 0x193D4D22…8D15ef, he was able to invoke LP and token migrations multiple times at:
https://explorer.bitquery.io/ru/bsc/txs/calls?contract=0xad4219cd…64d701&method=99594431
After, tokens were transferred to the external address multiple times, the example transaction:
https://bscscan.com/tx/0x5bb2d2ce…b0f9e2
Liquidity was removed multiple times, tokens were sold as well, the example transaction:
https://bscscan.com/tx/0x830f9f79…b144ba
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report fastswap.finance
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.