What happened
The attacker:
Address 0xfd54…0921, as was stated by the project team in the tweet:
tokenMigrate() function was called by the address which probably was saved to MasterChef in the constructor() initialization into private variable migrateAddress. Since the caller of the tokenMigrate() function was address 0x193D4D22…8D15ef, he was able to invoke LP and token migrations multiple times at:
After, tokens were transferred to the external address multiple times, the example transaction:
Liquidity was removed multiple times, tokens were sold as well, the example transaction:
Protocol details
Classification
Exchange (DEX)
Protocol Type
Exploit/Other
Affected asset / contract
FAST, Duke
Protocol links
Website
@fastswapdex
Evidence
- report Report fastswap.finance
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
