◈ A withdrawal wearing the label of its opposite
In the FastBNB contract's public interface, one function appears under the name Liquidity(uint256). To anyone scanning the contract — even a careful investor reading the function list — that name reads like liquidity management: adding to the pool, topping it up, protecting holders. It sounds like one of the good, defensive functions a project would want.
It does the opposite. Calling it transfers BNB straight out of the contract and into the owner's private wallet. No liquidity is added. It is a plain owner withdrawal — dressed in the name of the very thing it destroys. That mismatch between what the name implies and what the code does is exactly what misleads users into trusting a contract that can be emptied at any moment.
“Liquidity”
Reads as adding or protecting liquidity for holders — a reassuring, pro-investor action.
↗Owner-only drain
Sends BNB from the contract to the deployer's wallet. Repeatable, and used repeatedly.
↓The smoking gun is the decoded on-chain call itself — public, permanent, and reproducible on BscScan:
// Function called on the FastBNB contract (selector 0x198b2eae) Liquidity(uint256 amount) From : owner wallet 0xf7a4…9b57 To : FastBNB 0x8C70…2469 amount : 18000000000000000000 // = 18 BNB → result: 18 BNB transferred OUT of the contract to the owner
The contract's own design compounds the risk: users' principal deposits can't be withdrawn by users at all — the only path moving that BNB out is the owner's Liquidity() function. Ownership was never renounced.
! Impact
⌕ How we caught it
Not the project team. With no incentive to soften findings, we reviewed the contract purely in the depositor's interest.
We read each public/owner function by hand — invest, withdraw, and the innocuously named Liquidity — not just automated tool output.
We followed the owner wallet's outgoing BNB and matched every drain back to Liquidity() calls on the live contract via BscScan.
The result: a Critical finding backed by permanent, public transaction hashes anyone can open and verify — no trust required.
⛓ On-chain evidence — verify it yourself
Every claim on this page is checkable. Open any link and confirm the transfer from the FastBNB contract to the owner wallet on BscScan. We hold nothing back — this is exactly what the investor received.
This is what an audit is for.
A single disguised function can cost a community everything. Before you deposit — or before you launch — have the contract read by people whose only job is to find the trap.