# swapX: missing access control drains approved BUSD

swapX lacked access control on a swap function, letting an attacker drain BUSD from victims who had approved the contract, netting ~$1M.

- Payout: Real-world hack
- Severity: high
- Program: - swapX
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/SwapX_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230227-swapx
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** swapX contract on BSC
**Root cause:** The swapX contract exposed a function (selector 0x4f1f05bc) that allowed arbitrary callers to specify a victim address and spend their BUSD allowance without proper authorization.
**Steps:**
1. Attacker calls swapX with selector `0x4f1f05bc`, passing a swap path `[BUSD, WBNB, DND]`, the victim's BUSD allowance amount, and the victim address.
2. swapX pulls BUSD from the victim using the existing allowance and swaps it to DND via the provided path.
3. Repeat for each victim with a non-zero BUSD allowance to swapX.
4. Swap accumulated DND to WBNB via PancakeSwap router to realize profit.
**Exploitation:** Attacker iterated over 16 victim addresses, calling swapX's vulnerable function to spend each victim's BUSD allowance, converting to DND, then swapping DND to WBNB for ~$1M profit.
**Insight:** When a contract holds token allowances from many users, check if any function lets an arbitrary caller specify the 'from' address or spend allowances without verifying msg.sender.