Real finding · Verifiable on-chain

The function named “Liquidity” that quietly drained investors

During an investor-commissioned audit of the FastBNB yield contract on BNB Chain, we found the owner could sweep every depositor's BNB out of the contract — through a public function whose name was built to look harmless. Below is the finding, its impact, how we caught it, and the on-chain evidence you can verify yourself.

ProjectFastBNB Yield
ChainBNB Chain (BSC)
AuditedJan 16, 2022
VerdictInsecure
CRITICAL
Severity of the finding
3
Critical issues found
100%
Of deposits at owner's mercy
Investor
Who commissioned it
The finding

A withdrawal wearing the label of its opposite

In the FastBNB contract's public interface, one function appears under the name Liquidity(uint256). To anyone scanning the contract — even a careful investor reading the function list — that name reads like liquidity management: adding to the pool, topping it up, protecting holders. It sounds like one of the good, defensive functions a project would want.

It does the opposite. Calling it transfers BNB straight out of the contract and into the owner's private wallet. No liquidity is added. It is a plain owner withdrawal — dressed in the name of the very thing it destroys. That mismatch between what the name implies and what the code does is exactly what misleads users into trusting a contract that can be emptied at any moment.

What the name implies

“Liquidity”

Reads as adding or protecting liquidity for holders — a reassuring, pro-investor action.

What the code does

Owner-only drain

Sends BNB from the contract to the deployer's wallet. Repeatable, and used repeatedly.

The smoking gun is the decoded on-chain call itself — public, permanent, and reproducible on BscScan:

decoded transaction · bscscan.com
// Function called on the FastBNB contract (selector 0x198b2eae)
Liquidity(uint256 amount)

  From    : owner wallet   0xf7a4…9b57
  To      : FastBNB        0x8C70…2469
  amount  : 18000000000000000000   // = 18 BNB

  → result: 18 BNB transferred OUT of the contract to the owner

The contract's own design compounds the risk: users' principal deposits can't be withdrawn by users at all — the only path moving that BNB out is the owner's Liquidity() function. Ownership was never renounced.

Why it matters

! Impact

Total loss of principalThe owner can withdraw the entire contract balance at will — every depositor's BNB, at any time, without warning.
Asymmetric by designInvestors cannot withdraw their principal by any function. Only the owner's disguised drain moves those funds — a textbook rug-pull structure.
Already exercised, repeatedlyThis isn't theoretical. The owner wallet shows the withdrawal being executed again and again against the contract — the transactions are listed as evidence below.
Verdict: InsecureBecause of this one power, the whole contract is unsafe for depositors regardless of its yield promises. We marked it Insecure and advised the investor accordingly.
The method

How we caught it

01 · Independent mandate Commissioned by an investor

Not the project team. With no incentive to soften findings, we reviewed the contract purely in the depositor's interest.

02 · Manual review Every state-changing entry point

We read each public/owner function by hand — invest, withdraw, and the innocuously named Liquidity — not just automated tool output.

03 · On-chain forensics Traced the money

We followed the owner wallet's outgoing BNB and matched every drain back to Liquidity() calls on the live contract via BscScan.

04 · Reproducible proof Documented with real txns

The result: a Critical finding backed by permanent, public transaction hashes anyone can open and verify — no trust required.

The proof

On-chain evidence — verify it yourself

🛈

Every claim on this page is checkable. Open any link and confirm the transfer from the FastBNB contract to the owner wallet on BscScan. We hold nothing back — this is exactly what the investor received.

Addresses
FastBNB Yield contract Contract
0x8C705C8814D5A1E4b7b12ca4c6c745FFf5C42469
View on BscScan
Owner / beneficiary wallet Receives the funds
0xf7a457999cf09a9da7463ff3105fe5d1760a9b57
View on BscScan
Withdrawal transactions — contract → owner (click any row to open on BscScan)
01
Owner withdrawal 18 BNB · decoded above
0xbe5c5a16…19a8018c
Verify on Explorer
02
Owner withdrawal
0x7417b58a…bacf0df3
Verify on Explorer
03
Owner withdrawal
0xad2a8a1a…2b295385
Verify on Explorer
04
Owner withdrawal
0xd898015a…f767642e
Verify on Explorer
05
Owner withdrawal
0x86b7845b…8f373fc1
Verify on Explorer
06
Owner withdrawal
0xf8387cfe…a9698f46
Verify on Explorer
07
Owner withdrawal
0x66ef057c…aae80f38
Verify on Explorer
08
Owner withdrawal
0x475fc0ed…e3d0c5c5
Verify on Explorer
09
Owner withdrawal
0x08b563f8…876089a8
Verify on Explorer
10
Owner withdrawal
0xd6b97b93…de298a7f
Verify on Explorer

This is what an audit is for.

A single disguised function can cost a community everything. Before you deposit — or before you launch — have the contract read by people whose only job is to find the trap.