https://bscscan.com/address/0x7e0c621ea9f7afd5b86a50b0942eae...
Note line 304 the O is a 0:
bytes32 slot = ADMIN_SL0T;
https://bscscan.com/address/0x7e0c621ea9f7afd5b86a50b0942eae...
Note line 304 the O is a 0:
bytes32 slot = ADMIN_SL0T;
This is like in Java, where you mean to override a method in a superclass but mis-spell the name of the method and therefore instead end up simply adding a new method with the mis-spelled name.
I guess either Solidity doesn't have something like Java 1.5+'s @Override, or else it just wasn't used.
In any case it's hard to believe this was accidental. Of all the places you could make this mistake, most of the others wouldn't result in a massive exploit like this.
But I agree, that's not what happened here.
In short:
* the smart contact is made in a way that allows upgrades by an administrator * the developers transfer their administrator privileges to another user as a show of good faith * the code to transfer the privileges actually doesn't do anything * the developers upgrade the contract giving themselves permission to take the funds
Then elsewhere on line 50, anybody who creates a Proxy object will automatically be made the admin with zero auth.