79thVault: $12.5M Drained via Admin Role Abuse on BNB Chain, 92% Returned

Root Cause

On October 7, 2026, approximately 2.01 million 79AU tokens were removed from 79thVault's PancakeSwap V2 liquidity pool on BNB Chain. A privileged administrative function in the 79AU token or vault contract allowed a single admin address to pull tokens directly from the LP position — with no time-lock, multi-signature requirement, or community veto mechanism.

Whether the admin private key was externally compromised or the function was invoked by an insider remains unresolved. The project attributed the loss to "weaknesses in account permission management."

// Illustrative vulnerable pattern (inferred from reports and on-chain behavior)
address public admin;
address public lpPair; // PancakeSwap V2 pair

modifier onlyAdmin() {
    require(msg.sender == admin, "Not admin");
    _;
}

// No time-lock, no multi-sig guard, no max-withdrawal cap
// A single compromised EOA can drain the entire pool instantly
function emergencyWithdraw(uint256 amount) external onlyAdmin {
    IERC20(lpPair).transfer(admin, amount);
    // LP tokens are then used to remove liquidity from PancakeSwap
}

The critical structural flaw: a single EOA admin key with direct, instant control over the protocol's entire liquidity position. "Locked" liquidity via third-party lockers (e.g., Unicrypt, PinkLock) is irrelevant if the protocol has its own admin withdrawal path — the lock only protects tokens the admin deposited into the locker, not ones retained under admin control.

Attack Steps

Impact

• Initial drain: 16,249 BNB ≈ $12.5M (Bitquery: $14.35M in USDT equivalent)
• Recovered: 15,000 BNB ≈ $11.1M (~92%)
• Net loss: ~1,249 BNB ≈ ~$925K
• Chain: BNB Chain
• DEX: PancakeSwap V2
• LP token handling: Recovered BNB to be re-deposited; resulting LP tokens to be permanently burned

Lessons for Auditors

1. Time-lock all liquidity management functions. Any function that can remove, drain, or migrate protocol liquidity must be gated behind a minimum 48–72 hour time-lock. Use TimelockController (OpenZeppelin) or a dedicated governance module with a mandatory delay.
2. Require multi-sig for LP management. A single EOA admin key is a single point of failure for the entire protocol treasury. Require ≥3-of-N Safe multisig for any function touching PancakeSwap LP positions.
3. Locked liquidity ≠ safe liquidity. Auditors must verify whether custom admin functions can bypass third-party LP locks. The existence of a Unicrypt lock does NOT protect admin-controlled LP tokens.
4. Classify EOA-admin functions as critical severity. Any permissioned function callable by a single EOA that can drain user funds should be flagged as a critical finding, requiring upgrade to multisig + time-lock before deployment.
5. Distinguish hack from insider risk in reviews. When the exploit path is "admin function was called," auditors must assess key-management procedures as part of the security scope, not just smart contract code.