What happened
The attack description:
- Deploying MasterChef
- Setting MasterChef ownership to the unverified smart contract:
https://bscscan.com/tx/0xdc7478ac…7ca13b
3. Unverified contract was set as the migrator:
https://bscscan.com/address/0xf5b2f301…9f563f
- Calling migrate function on each pool, even without any tokens already staked, this call still grants an infinite amount of allowance to the current migrator, which is the unverified contract.
- Setting migrator back to 0x0000000 (this covers up their tracks that something fishy already happened)
- Transfering MasterChef ownership to the Timelock contract
- Executing rug pull method in the unverified contract:
https://bscscan.com/tx/0xaab125fa…a969da
Case & protocol details
Classification
Exchange (DEX)
Protocol Type
DEX
Affected asset / contract
HONEY
Official Website
honeyswap.fi/
Protocol Twitter/X
@honeyswapbsc
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.