Report · BNB Chain · Sep 8, 2026
HWAN Protocol
BSC staking scheme promising ~1.74%/day to 2x. 10% of every deposit skims to 4 wallets, payouts come from a shared ~$1.18M pool with no lock, a keeper key retains uncapped payout control, and anyone can log in as any user with no signature.
86/100
High RISK · 0 reads1 They promise your money doubles
Where the story starts — and the math that has to pay for it.
Put in $100 of USDT and the app shows earnings of about $1.25 a day, heading to $200 in roughly 5 months — plus commissions for bringing friends, down 20 levels. Nothing is ever invested anywhere: there is no trading, no lending, no business. The only money in the system is deposits.
stakeTokens() writes stakes paying dailyRoi = mintValue × 174/10000 (1.74% of post-fee mint value) to a hard totalRoi = 2× gross via claimRoi() (whole-day windows, sub-day remainder forfeited). 5% direct (1 level) + generation income over 20 upline levels (10% → 0.3% of each claim, $50-qualified gating). Cap 2x, 3x after first referral. No external yield source exists in the code.
2 $10 of every $100 leaves instantly
Before your deposit earns a cent, a cut goes to private wallets.
The moment you deposit, 10% is siphoned off to four fixed wallets, and another 5% is earmarked for a bonus pool the operators distribute. Only about $85 of your $100 actually backs the pool that pays everyone.
ECOSYSTEM_FEE_PCT = 10 → 2.5% each to _REWARD_WALLET_1..4 (:165-173, :587-605); DAO_PCT = 5 accrues to daoPoolTotal. Full post-fee remainder backs liquidityPool.
Where each $100 deposit goes, on arrival: $10 instant fees → 4 wallets · $5 DAO pool · $85 backs payouts.
3 Your profit is other people's deposits
The core of the case: one shared pot, no lock, no outside income.
All deposits sit in one contract-controlled pot (about $1.18M at scan time). Every payout — daily returns, referral cuts, bonuses — is drawn from that same pot. Every withdrawal drains it. There is no lock protecting it and no business refilling it. It balances only while new deposits keep arriving — the textbook definition of a pay-from-deposits scheme.
liquidityPool is bookkeeping, not locked LP: USDT held by the scheme contract itself (live balance ≈ 1,183,838 vs pool ≈ 1,181,058). Sells subtract full value from the pool; chain census: 120,556 txns, 8,645 stakes (~$1.01M est.), 54,145 claims firing 413,775 downline payouts (DOCS/all-chain-txns.jsonl; backend logs barely half). Price = pool ÷ supply, monotonically non-decreasing (sells burn 100% supply, remove 85% pool) — the "always up" chart is arithmetic.
InNew deposits +90% of each
PotOne shared pool, ~$1.18M
OutROI + referrals + exits drain it
4 Getting money out costs you ~20%
Three gates stand between your screen balance and cash.
Your $100 of earnings doesn't come home as $100. Withdrawing converts it to tokens minus a 5% fee, and converting those tokens back to dollars keeps only 85% — about $80 in hand, capped at $3,000 a day, and only if the pool still has it.
withdraw() (10–3,000, pays in HWAN at currentPrice minus 5% token fee to WALLET_WITHDRAW_FEE1..4) → sellTokens() (85% of value, 3,000/day/user cap, pool must cover full value). Caps bind every wallet incl. keeper/admin — no exemptions; the bypass is volume (unlimited txns/wallets) plus uncapped DAO distributions. Lifetime credits capped at 2x deposits (3x with ≥1 referral); DAO/rank credits excepted.
$100 screen balance
− 5% withdraw fee → tokens
− 15% sell haircut → USDT
≈ $80 in hand, if the pool holds
5 “Nobody controls it” — except one key
The decentralisation claim, checked against the code.
Ownership is publicly "renounced" — which sounds safe. But a single operator key (the keeper) can still print bonus rewards with no cap, hand out the bonus pool however it likes, and two hidden signer wallets can replace that key at any time. There is no instant-drain button — instead the machine skims 10% of every deposit automatically, and fee wallets forward it to a consolidator. The emergency brake (pause) has no working operator. Renounced in name, controlled in fact.
admin() = 0x0 but chainKeeper 0x3e8e…52e1e2f alone calls updateRewardIncome (rank rewards to 80,000, zero remainingCap interaction), updateRankIncentive, setDaoEligible + distributeDao (DAO excluded from caps); 2-of-2 adminSigners (0x48e4…6849, 0xd4fa…31e0ae) rotate the keeper via setChainKeeper. Claims + withdrawals ignore pause; pause itself is bricked (no admin). No instant-drain function exists — but keeper can print-then-sell wallets dry slowly; observed cash-out is automatic fee skim + manual forwarding to consolidator 0x9b8a…7299b. Audit: 13 findings — incl. direct-income overpay, sell-cap doc lie, ghost-credit wipe — reentrancy + multisig clean.
6 Anyone can log in as you
Demonstrated live — no hacking required, just asking.
The app asks your wallet to sign a login message — then throws the signature away and logs in whoever names your public address. We logged in as half a dozen accounts — strangers, a referrer, the system's first account — typing nothing but their public wallet numbers. Your balances, earnings and entire downline are readable by anyone who knows your address — and every address is public.
Bundle
fe() signs Welcome to HWAN Protocol!\n\nAction: Login\nWallet: 0x… via personal_sign; return value discarded; POST /api/auth/login {wallet_address} alone returns a valid HS256 JWT (~24h). Reproduced for users 6618, 4623 (referrer), 6114, 5607, 13, 3 and 1 (root). Admin API correctly 401s user tokens; forged alg:none/empty/null also 401. JWT secret survived 14.3M rockyou + targeted rounds — issuance, not crypto, is the flaw.
Step 1App asks wallet to sign
Step 2Signature discarded
Step 3Address alone → full session
curl -X POST https://backend.hwanprotocol.io/api/auth/login -H 'Content-Type: application/json' -d '{"wallet_address":"0x228a21dD708e6EE92bA67c31b892a9C62f2214d5"}'
7 The people behind it don't exist on paper
Three-month-old shell, hidden ownership, one operator wallet.
The website is 3 months old, registered for a single year behind a privacy shield. No company, no names, no faces, no office, no audit — anywhere. The one traceable lead: the system's first account (created before all others, never deposited a cent) sits atop a 5,524-member tree — the classic operator's seat. Anonymous people, real money.
hwanprotocol.io created 2026-05-28, 1-yr NameCheap, registrant Withheld-for-Privacy, Cloudflare (DOCS/whois-*.html). Backend user 1 HWN2778300 = 0x6000…c3dd, referrer-less root, created 2026-07-10T12:27:34Z, 0 staked, 5,524 team (DOCS/dashboard-user1-root.json). Keeper/signer/fee-wallet cluster in LINKS.md; funding trails open.
8 The site vs the code
Claims from hwanprotocol.io, checked against the verified contract.
The website describes a different machine than the one deployed. “80% minted to the staker” is really 72% locked in the contract's own escrow; “20% to liquidity” is really 90%; “no admin keys” hides the keeper key; “fully automated on-chain” hides the keeper-run bonuses; the “two independent auditors” are never named.
FALSE — “80% minted to the staker”: code mints 80% of post-fee remainder (72% gross) to
address(this) escrow, staker receives nothing directly. FALSE — “20% to liquidity”: full post-fee 90% backs liquidityPool. MISLEADING — “no admin keys / no hidden control”: keeper + 2 signers retain payout control. FALSE — “fully automated on-chain”: DAO/rank are keeper-signed off-chain flows. UNVERIFIABLE — “reviewed by two independent firms”: no names anywhere. FABRICATED — “treasury strategies / AI intelligence / peg defense”: no such code exists. CONTRADICTORY — deposit caps stated as both $1,000 and $5,000 (code: 1,000). TRUE — 1.25% ROI (of gross), 2x cap, 100% sell burn, one-way price, $125K rank max (matches audit math).
9 Where the skimmed money went — receipts
Fee wallets don't hoard — they sweep. Every row below is a live on-chain transfer. Click any hash to verify it yourself.
Three of the four fee wallets swept $106,744 out to private hands (RWD1 $40,353 · RWD4 $40,250 · RWD3 $26,141). At least 24 transfers went straight to one consolidator wallet, which breaks the money into small chunks. Live balances in the fee wallets today: dust.
Traced from wallet-trails (28,337 unique txns): USDT transfers out of the fee wallets. RWD1 $40,353.43 · RWD4 $40,250.00 · RWD3 $26,141.00 swept; 24 hops land on consolidator 0x9b8a…7299b. RWD2 + withdraw-fee wallets pending pull.
| Date | From → to | Amount | Receipt |
|---|---|---|---|
| 2026-09-01 | RWD4 → consolidator | 6,000 USDT | 0x4bb8…767c4 |
| 2026-09-07 | RWD4 → consolidator | 3,200 USDT | 0x5ce5…d224 |
| 2026-08-11 | RWD3 → consolidator | 3,050 USDT | 0xfdf1…25c |
| 2026-07-24 | RWD4 → consolidator | 2,800 USDT | 0x0633…71bf |
| 2026-08-02 | RWD4 → consolidator | 2,500 USDT | 0x4295…a40e |
Proofconsolidator 0x9b8a…7299b on BSCScanfee wallets RWD1 0x0609…22E · RWD3 0xc61C…617 · RWD4 0x2B77…f72
Evidence pack
Verify everything yourself — every card links to live proof. Captured: SCREENSHOTS/admin-login.png (control-center login; note the admin@hwan.network placeholder — that domain doesn't resolve). BSCScan blocks headless capture — screenshot its pages manually.
Scheme contract0xe897…71a6 · verified source ·
DOCS/HWANProtocol.solHWAN token0x3e79…eFE1 · minter = scheme
Keeper + signerskeeper 0x3e8e…52e1e2f ·
DOCS/source-0xe897….json ctor argsFee wallets (10% skim)0x0609…22E · 0x003b…675 · 0xc61C…617 · 0x2B77…f72 ·
HWANProtocol.sol:165-173Account-creation tx0x20bbc99e…4d9deb · EIP-7702 ·
DOCS/tx-*-receipt.jsonAuth bypass PoCno-signature login → valid JWT, reproduced Sep 08 (replay above)
Domain WHOIScreated 2026-05-28 · NameCheap · privacy-shielded ·
DOCS/whois-*.htmlRoot account (user 1)0x6000…c3dd · no referrer · 5,524-member tree ·
DOCS/dashboard-user1-root.jsonChain census120,556 txns · 8,645 stakes · 413,775 MLM payouts ·
DOCS/all-chain-txns.jsonlCash-out trailfee sweep → consolidator 0x9b8a…7299b (~$40k) ·
DOCS/wallet-trails.jsonlAdmin paneladmin.hwanprotocol.io · email login · DAO payout trigger · user tokens 401 ·
DOCS/admin-bundle-*.jsCaptured: the control center
Screenshot taken Sep 08, 2026 of the live admin login. Note the email placeholder — that domain doesn't even resolve.
admin.hwanprotocol.io/login — email + password gate to the payout trigger. Probed with a user token: 401. Login itself left untouched.
Published by PreInvest · Same checklist, every case · Never removed for payment.
Update log
Corrections and re-scans, newest last. History is never rewritten.
2026-09-08Report published — contract review, backend scan, auth-bypass PoC.
2026-09-08Re-scan: WHOIS logged (domain 3 months old); app bundle has no admin routes, search index empty.
2026-09-08Admin panel found at admin.hwanprotocol.io — user tokens rejected (401); payout trigger left untouched.
2026-09-08Root account traced via referral climb: user 1, wallet 0x6000...c3dd, 5,524-member tree.
2026-09-08Contract audit: 13 findings (overpay bug, pause gap, never-falling price, doc lies); reentrancy + multisig clean.
2026-09-08Full chain census via Covalent: 120,556 txns; backend under-logs ~2x; inflow corrected to ~$1.01M.
2026-09-08Drain analysis: no instant-drain function; observed cash-out is auto-skim plus forwarding to consolidator 0x9b8a...7299b.
2026-09-08Marketing site scraped: claim-vs-reality check added, socials traced (Telegram/FB/IG).