# DxSale Legacy Locker: owner backdoor drains locked LP

DxSale's legacy liquidity locker held an owner-only backdoor DXLOCKERLP() that let the attacker drain 1,400+ locked LP positions worth ~$7.3M in BNB.

- Payout: Real-world hack
- Severity: critical
- Program: DxSale
- Credited: Tahax1
- Disclosed: 2026-05-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/DxSale_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260528-dxsale
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:reverse-engineering technique:source-review vuln:access-control vuln:business-logic

**Target:** BSC liquidity locker contract (unverified bytecode)
**Root cause:** Unverified locker bytecode contained an owner-only function DXLOCKERLP(address,uint256) that bypassed per-user timelocks and released any locked LP position. Ownership of the locker had been quietly transferred through 89 wallets over 269 days to the attacker.
**Steps:**
1. Fork BSC at block 100806731-1.
2. Confirm attacker 0xC4574DDEF299e7E563971e200433e592EeaaFA69 is owner of locker 0xEb3a9C56d963b971d320f889bE2fb8B59853e449.
3. Enumerate victim locks via `UserLockerCount(victim)`.
4. As owner call `DXLOCKERLP(victim, lockId)` for each lockId to release locked LP/BNB ignoring timelock.
5. Repeat across 1400+ victims; route drained WBNB to attacker wallets.
**How found:** On-chain analysts (Tahax) traced locker ownership history and found 80+ ownership-transfer transactions over months ending at attacker 0xC457; Coinsult decoded unverified bytecode selectors via 4byte.directory and identified the privileged DXLOCKERLP backdoor.
**Exploitation:** Attacker acquired locker ownership via a 269-day, 89-wallet transfer chain, then used an EIP-7702 type-4 delegation to a custom drainer contract (0x74ad1ef17fbb3e494c31c72f7ec730a27fef0310) that batch-called DXLOCKERLP(victim, lockId) across 1,400+ locked positions, draining ~$7.3M in BNB; ~$1.87M moved to Binance deposit addresses.
**Escalation:** Batch execution via EIP-7702 delegated drainer contract scaled single-owner backdoor call across all 1,400+ victims in one sweep.
**Insight:** For legacy DeFi contracts with unverified bytecode, decode selectors via 4byte.directory and diff against documented ABI; also trace Ownable transfer history — silent multi-hop ownership handoffs to fresh wallets are a strong precursor to privileged-drain exploits.