Incident Overview
Wallstreetswap Finance rug pulled its investors by introducing a backdoor into its smart contracts, granting the project deployer to transfer of all LP positions at will. The exploit cost investors approx. $2,9 million in damages.
Wallstreetswap Finance was a DEX on the Binance Smart Chain that offered the typical DEX services such as staking, farming, and swapping. The factory contract contains a line that approves both tokens' balances to the malicious actor in every created LP inside initialize() function. This means that the malicious actor can perform liquidity withdrawal from the pools anytime.
LP creation contract WallStreetSwapFactory:
https://bscscan.com/address/0xd395ce2b…611d6c#code
Contract deployer (scammer) address:
https://bscscan.com/address/0xa7524ec3…778304
Some example of token draining:
https://bscscan.com/tx/0xb8fb142a…c0a5a3
https://bscscan.com/tx/0xb0548033…ca6d26
In this last transaction the contract deployer transferred all stolen $BNB to a third seemingly unrelated address:
https://bscscan.com/tx/0x92d301e0…52d7e7
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Wallstreetswap Finance, these are the critical security checks that could have prevented this incident (February 2021).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Wallstreetswap Finance
The Wallstreetswap Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.