# HPAY: unprotected setToken lets attacker mint fake stake rewards

HPAY bonus contract let anyone setToken to an arbitrary token, stake it, then switch back to HPAY and withdraw inflated rewards, draining ~115 BNB.

- Payout: Real-world hack
- Severity: high
- Program: HPAY
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/HPAY_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221018-hpay
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** BEP20 staking/reward bonus contract (MintableAutoCompundRelockBonus)
**Root cause:** The bonus contract's setToken() is callable by anyone, letting an attacker point the staking token at a self-minted token, stake it, then repoint to HPAY and withdraw rewards denominated in HPAY.
**Steps:**
1. Deploy a fake ERC20 (SHITCOIN) with a public mint() and mint 100,000,000e18 to self.
2. Call `BONUS.setToken(address(shitcoin))` to make the bonus contract accept the fake token.
3. Approve and call `BONUS.stake(shitcoin.balanceOf(this))` to register a huge stake.
4. Advance block number (`vm.roll(block.number + 1000)`) to accrue rewards.
5. Call `BONUS.setToken(address(HPAY_TOKEN))` to switch the reward token back to HPAY.
6. Call `BONUS.withdraw(30_000_000e18)` to receive HPAY rewards.
7. Swap HPAY to WBNB via PancakeSwap router.
**Exploitation:** Attacker deployed a mintable fake token, set it as the bonus contract's staking token, staked 100M fake tokens, advanced blocks to accrue rewards, switched the token back to HPAY, and withdrew 30M HPAY which was swapped to ~115 BNB.
**Insight:** Reward/staking contracts that expose a public setToken() or similar config setter let an attacker substitute a self-minted token to inflate stake weight, then flip back to the real reward token before withdraw — check every externally callable setter on reward accounting contracts.