# AurumNodePool: missing permission check lets attacker set node reward

AurumNodePool lacked access control on changeNodePrice and changeRewardPerNode, letting an attacker set a huge reward and drain ~$13k in AUR.

- Payout: Real-world hack
- Severity: high
- Program: - AUR
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/AUR_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221122-aur
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** BSC staking/node pool contract (AurumNodePool)
**Root cause:** Privileged admin functions changeNodePrice and changeRewardPerNode had no permission check, so any caller could set the node price and per-node reward arbitrarily.
**Steps:**
1. Swap 0.01 BNB to AUR via PancakeSwap router.
2. Approve AUR to AurumNodePool.
3. Call `changeNodePrice(1_000_000_000_000_000_000_000)` to set a cheap node price.
4. Call `createNode(1)` to register a node.
5. Read node creationTime via `getNodes(address(this))`.
6. Warp time forward past lastClaimTime.
7. Call `changeRewardPerNode(434_159_898_144_856_792_986_061_626_032)` to inflate reward.
8. Call `claimNodeReward(creationTime)` to claim inflated AUR.
9. Swap AUR back to BNB.
**Exploitation:** Attacker bought a small amount of AUR, set the node price low and reward per node astronomically high via unprotected admin setters, created a node, waited past the claim window, claimed the inflated reward, and swapped the AUR for BNB for ~$13k profit.
**Insight:** On staking/node-pool contracts, check whether admin setters (price, reward rate) are actually gated; if reward-per-node is caller-settable, a single node plus a time warp yields unbounded claims.