Wallstreetswap Finance Hack

Wallstreetswap Finance rug pulled its investors by introducing a backdoor into its smart contracts, granting the project deployer to transfer of all LP positions at will. The exploit cost investors approx. $2,9 million in damages.

Wallstreetswap Finance was a DEX on the Binance Smart Chain that offered the typical DEX services such as staking, farming, and swapping. The factory contract contains a line that approves both tokens' balances to the malicious actor in every created LP inside initialize() function. This means that the malicious actor can perform liquidity withdrawal from the pools anytime.

LP creation contract WallStreetSwapFactory:

https://bscscan.com/address/0xd395ce2b…611d6c#code

Contract deployer (scammer) address:

https://bscscan.com/address/0xa7524ec3…778304

Some example of token draining:

https://bscscan.com/tx/0xb8fb142a…c0a5a3

https://bscscan.com/tx/0xb0548033…ca6d26

In this last transaction the contract deployer transferred  all stolen $BNB to a third seemingly unrelated address:

https://bscscan.com/tx/0x92d301e0…52d7e7