# FPR: missing access control on setAdmin drains liquidity

FPR token contracts lacked access control on setAdmin and remaining, letting an attacker mint/transfer tokens and drain ~$29k from liquidity pools.

- Payout: Real-world hack
- Severity: high
- Program: - FPR
- Analysis by: DeFiHackLabs
- Disclosed: 2022-12-14
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-12/FPR_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20221214-fpr
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** FPR token contracts and Uniswap V2 pair
**Root cause:** The vulnerable contracts exposed setAdmin and remaining functions without proper access control, allowing anyone to become admin and transfer tokens from arbitrary addresses.
**Steps:**
1. Attacker calls `setAdmin(address(this))` on vulnerable contract 0x81c5664be54d89E725ef155F14cf34e6213297B7.
2. Attacker calls `remaining(address(this), address(FPR))` to transfer FPR tokens to the attack contract.
3. Attacker swaps the received FPR tokens for USDT via Uniswap V2 router.
4. Repeat steps 1-3 for contracts 0xE2f0A9B60858f436e1f74d8CdbE03625b9bcc532 and 0x39eb555f5F7AFd11224ca10E406Dba05B4e21BD3.
5. Call `setAdmin(address(this))` on contract 0xBa5B235CDDaAc2595bcE6BaB79274F57FB82Bf27, then `remaining(address(this), address(pair))` to transfer LP tokens to the attacker.
6. Remove liquidity from the Uniswap V2 pair using the stolen LP tokens, then swap remaining FPR for USDT.
**Exploitation:** The attacker used the unprotected setAdmin to gain control of four contracts, then called remaining to transfer FPR tokens and LP tokens to themselves, swapping and removing liquidity for profit.
**Insight:** Look for token contracts with public setAdmin or similar privileged functions that lack access control; these can be used to mint or transfer tokens from any address, draining liquidity pools.