Incident Overview
Swello Finance has been rugpulled by the contract owner of the project. The contract owner called the pullForBNB() function through an unverified contract that dumped $SWLO against $WBNB via PancakeSwap.
Swello Finance was a staking service provider with a high APY rating.
The token owner address received 3.8b $SWLO tokens from the contract deployer in this tx: https://bscscan.com/tx/0x66bc6833…c690a4.
Then the token owner interacted with an unverified smart contract that was created by the scammer. By calling the pullForBNB() function the smart contract exchanged 7.3b $SWLO tokens in total on PancakeSwap to ~891 WBNB and transferred the funds to the scammer wallet address (https://bscscan.com/tx/0xb99d2914…5b9971).
As the time of this writing information on this case is scarce. More sources will be added if the case should develop.
Scammer address (A): https://bscscan.com/address/0xf23c31aa…b67c32
Scammer address (B): https://bscscan.com/address/0x70d4a89b…e13100
Scammer's contract: https://bscscan.com/address/0x4aa97b49…3d5e6f
Involved addresses:
https://bscscan.com/address/0x511396d9…5dc22c
https://bscscan.com/address/0x7cc49028…be7e79
Addresses contacted with scammer's contract: https://bscscan.com/address/0x4aa97b49…3d5e6f#tokentxns
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Swello Finance, these are the critical security checks that could have prevented this incident (June 2022).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Swello Finance
The Swello Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.