# Bitswift Unlimited Mint Bugfix Review

BitSwift's /bcad/credit endpoint lacked admin permission checks, letting any authenticated user mint unlimited BCAD tokens and drain liquidity pools.

- Payout: $4,515
- Severity: critical
- Program: BitSwift Cash
- Disclosed: 2021-01-30
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/bitswift-unlimited-mint-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-bitswift-unlimited-mint-bugfix-review
- Tags: domain:web domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:jwt tech:rest technique:js-analysis technique:source-review vuln:access-control vuln:business-logic

**Target:** dApp web API endpoint /bcad/credit (JWT-authenticated REST)
**Root cause:** The /bcad/credit endpoint performed no admin/permission check, so any authenticated non-admin JWT could call it and credit arbitrary BCAD amounts to their own account.
**Steps:**
1. Read main.js to enumerate API endpoints; note JWT-based auth and admin:false claim in JWT payload.
2. Identify /bcad/credit endpoint lacking permission checks.
3. Obtain a normal user JWT and unique_message from your account.
4. POST to `https://bitswift.cash:8443/bcad/credit` with `Authorization: Bearer <token>` and body `{"amount":9999999999999999,"unique_message":"<your unique_message>"}`.
5. Observe success response despite non-admin status; tokens credited.
**How found:** Researcher reviewed the dApp's JavaScript (main.js) to map endpoints and architecture, noticed JWT payloads carried an admin:false claim used for access control, then checked each endpoint and found /bcad/credit had no permission check.
**Exploitation:** Attacker mints an arbitrary amount of BCAD into their own account via the unauthenticated-permission endpoint, then trades the minted tokens against open liquidity pools to drain them of value.
**Insight:** When a JWT carries an admin/role claim, enumerate every endpoint from the frontend JS bundle and test each one with a non-admin token — role checks are often applied inconsistently, and mint/credit endpoints are prime targets.