❗ About that DxSale locker 'backdoor', we have analysed it on-chain. Here is our take:
The drainer: 0xc2efbd94…01e4718, unverified, solc 0.8.33, deployed ~9h ago by 0xC4574DD…aaFA69. It hardcodes the victim locker as an immutable WBNB for routing, and gates every function to self-calls: a one-tx orchestrator.
Decoded call sequence on the locker:
1. setFee(1) - owner drops locking fee to 1 wei
2. lock(token, amount, unlockTime=68) - unlock time backdated to Jan 1970
3. setFee(~1e29) - restore the fee
4. withdraw() in a loop - pull tokens out
5. swap proceeds → WBNB → BNB
Takeaway: a locker is only as safe as its owner key. A privileged setFee plus a backdated lock turned "locked" deposits into a withdrawable balance. If your LP sits in an unverified & unaudited locker with a live (non-renounced, non-timelocked) owner, you should assume that owner can move it.
#dxsale #dxlock #hack #drain
Here's how the exploit unfolded.
269 days ago, the DxSale deployer quietly transferred ownership of the locker to a new wallet.
The locker contract? Unverified. A backdoor was left in
No announcement, no migration notice, just a silent handoff