HoneySwap.Fi Rug Pull

Reported loss $3.3M
BNB Chain
Rugpull

What happened

The attack description:

  1. Deploying MasterChef
  2. Setting MasterChef ownership to the unverified smart contract:

Tx 0xdc74…a13b

  1. Unverified contract was set as the migrator:

Address 0xf5b2…563f

  1. Calling migrate function on each pool, even without any tokens already staked, this call still grants an infinite amount of allowance to the current migrator, which is the unverified contract.
  2. Setting migrator back to 0x0000000 (this covers up their tracks that something fishy already happened)
  3. Transfering MasterChef ownership to the Timelock contract
  4. Executing rug pull method in the unverified contract:

Tx 0xaab1…69da

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract HONEY
Protocol links Website @honeyswapbsc

Evidence

Same attack technique

Browse all hacks →
BNB Chain Thunder Finance $19K lost Ethereum Focus $10K lost BNB Chain Wallstreetswap Finance $2.9M lost Ethereum NONAME $30K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes