What happened
The Master Chef contract contains hidden functionality under the set() function, which was invoked multiple times by the contract deployer at:
https://explorer.bitquery.io/bsc/txs/calls?internal=false&contract=0xb9c56744…3e7070&method=d9638422
Calling set() function led to the LP tokens transfer onto the external wallet, example transaction:
https://bscscan.com/tx/0x3b8ed32a…53de91 (at the bottom of the list)
The liquidity was removed by the external wallet multiple times at:
https://bscscan.com/tx/0x31c99d77…e84d55
https://bscscan.com/tx/0xde655409…4887cc
https://bscscan.com/tx/0x6c9d7e8b…e4de6b
https://bscscan.com/tx/0x21d2c374…e69a10
https://bscscan.com/tx/0x3a0c56b9…8cb1bb
https://bscscan.com/tx/0xdcd892c2…81b640
https://bscscan.com/tx/0x9033ed6a…9f1865
https://bscscan.com/tx/0x0deb3c97…d73e5e
https://bscscan.com/tx/0x53a1f15d…7da8e0
Case & protocol details
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.