Wallstreetswap Finance Rug Pull

Reported loss $2.9M
BNB Chain
Rugpull

What happened

WallStreetSwap Finance was a PancakeSwap-style DEX on BNB Chain with swapping, farming and staking, and its WALLST token was deployed on 14 February 2021. The backdoor sat in its pair contract: when the factory 0xd395ce2b…611d6c created a pool, the pool's initialize approved the factory's feeToSetter, the address that deployed the factory, to spend an unlimited amount of both pooled tokens. That address could therefore call transferFrom on any pool and take its reserves without holding LP tokens.

De.Fi's REKT database lists this as a rug pull on 15 February 2021 costing liquidity providers about $2.9 million, names 0xa7524ec3…778304 as the deployer, and cites transactions 0xb8fb142a…c0a5a3 and 0xb0548033…ca6d26 as examples of pools being drained, followed by 0x92d301e0…52d7e7, in which the BNB was sent to another address.

How it happened

  1. The factory constructor stores its deployer as feeToSetter = msg.sender.
  2. createPair deploys each pool with create2 and calls WallStreetSwapPair(pair).initialize(token0, token1, feeToSetter), passing feeToSetter into a parameter misleadingly named _factory.
  3. initialize runs IBEP20WallStreetSwap(_token0).approve(_factory, uint(-1)) and the same for _token1, so each new pool gives the fee setter an unlimited allowance over both of its tokens. The approval is set once per pool and stays even if feeToSetter is later changed.
  4. With that allowance, the fee setter can call transferFrom(pair, recipient, amount) on each pooled token and move the reserves out directly. The pair's swap, mint and burn functions never see it, and LP holders are left with claims on an emptied pool.
  5. De.Fi's REKT database cites drain transactions from the deployer and a final transfer of the collected BNB to a separate address, with total losses of about $2.9 million.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract WALLST
Protocol links Website @wallstreetswap

Evidence

Same attack technique

Browse all hacks →
BNB Chain Thunder Finance $19K lost Ethereum Focus $10K lost Ethereum NONAME $30K lost BNB Chain Astronaut NFT $187K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes