Thread by @ed_Nuward

I'll show you how a friend foolishly lost several $BNB by getting scammed

AND

How it could have been easily avoided !

SECURITY THREAD 🧵🧵🧵

Let's call this victim Paul!

Paul came across this Youtube video and followed the recommendations of this video.



DON'T DO IT !!!! IT IS A SCAM !!
It's just to show how you can avoid it

This video provides a so-called Arbitrage contract that it is possible to relaunch on Solidity to earn several $BNB per day from a single investment BNB.

Yes of course … we believe in it 🤬

But Paul was encouraged by all the positive comments on the video and so decided to take the test.
He then follows the steps described in the video:
a – Copy/Paste the smart contract on Remix
b – Deploy the Smart Contract
c – Send 1 BNB to the smart contract

d – Call the "Action" function of the smart contract
e – Wait a few hours for the smart contract to arbitrate and return +200/300% profit

Of course the last step never happened!
I'll show you how Paul could have avoided this scam without any technical skills!

The objective is to see if the last step (5) has been achieved for people who have followed the same process before Paul.

The starting point is the smart contract, in all smart contracts the function that transfers value is called "transfer" (yes logical) and the syntax is as follows:

addressReceiver.transfer(amount)

where « addressReceiver » is the address to which the funds are sent and « amount » the amount sent.

This is the only technical element to understand!

It is therefore necessary to go to the smartcontract to see this syntax to find to whom the funds will be sent.

In the "Action" function we find this line:
address(uint160(manager.pancakeswapDepositAddress())).transfer(address(this).balance);

The command sends all the BNB present in the contract to a « manager.pancakeswapDepositAddress() » address.

Here the scammer is trying to hide his address, just look for the "manager" imported file in which we should find « pancakeswapDepositAddress() » which contains the address.

The "manager" file is therefore imported from this link :
ipfs://Qmf6VGrKVuLRMqoyN5xr9vhZSqeBF37Fzq55uT7AjAa1dY

Here's what's on the link page:

Bingo we found the address, that's the most complicated part and as you can see it's not very difficult!

The next step is to verify who owns? Which addresses sent $BNB to this address? And finally, do these addresses receive $BNB in return or is it a one-way trip ?

Let's go to BSC scan and paste this address:
0x01B547630BF98c6EC57df5845520914CdD036c5d

We see that the address does not correspond to that of a smart contract, so it is the address of an account (it does not smell good).

When the "action" function is launched, the smart contract triggers the "transfer" function, so the $BNB are sent from a smart contract.

To see the transactions made from a smart contract you have to go to "Internal Txns":

Internal transactions correspond to step 4 of this diagram :

We can therefore go back to the addresses of the different smart contracts !

The "From" column of the internal transactions corresponds to the various smart contracts deployed by all the victims.

Take for example the last internal transaction at 0.9 $BNB.

Let's click on the address that is in the "From" column.

We therefore see all the transactions relating to the deployed smart contract :

Here we can see all the interactions the victim had with the contract he created.

In the "From" column we have the address of the victim's account.

We can directly go to these transactions to see whether or not she received the $BNB she sent and therefore check step 5 of this

Finally, we see directly that the victim has received nothing, no "IN" transaction since his interaction with the smart contract...

Step 5 is therefore wrong.
We proove that is a SCAM.

You can do the same thing we all others smarts contract addresses here

Moral of this THREAD:

1 – Never launch or interact with a smart contract that you do not understand or not audited

2 – If you still want to do it, do some basic checks using what I just showed you.

The Blockchain is public, so take advantage of it!

Mention :
@CryptoKaduna
@DeFi_Made_Here
@Chinchillah_
@defi_mochi
@phtevenstrong
@DefiIgnas
@TheDeFinvestor
@LouisCooper_
@PowerHasheur
@crypthoem
@OnchainDataNerd
@crypto_linn
@Crypt0Ricard0
@EricCryptoman
Thanks to share this THREAD to make everyone aware.

https://twitter.com/ed_Nuward/status/1638441604665991168?s=20

I hope you enjoyed it, don't hesitate to let me know in the comments, without forgetting to like and RT the first tweet of the thread!

Stay safe and learn 💪
#Cryptocurency #Security #Scam #BNB #Solidity #BlockExplorer #blockchain #smartcontract