# Local Trade LCT: access control lets attacker set price and drain

Improper access control in Local Trade LCT's close-source proxy let attacker set ownership and price to 1, buying cheap LCT and swapping for ~384 BNB.

- Payout: Real-world hack
- Severity: high
- Program: Local Trade LCT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-05-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-05/LocalTrader_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230524-localtrader
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** LCTExchange proxy contract on BSC
**Root cause:** The close-source proxy contract lacked proper access control on functions to change ownership and set token price, allowing anyone to call them.
**Steps:**
1. Call victim_proxy at `0x303554d4D8Bd01f18C6fA4A8df3FF57A96071a41` with selector `0xb5863c10` and argument `0x0567F2323251f0Aab15c8dFb1967E4e8A7D42aeE` to change ownership.
2. Call victim_proxy with selector `0x925d400c` and argument `1` to set price to 1.
3. Call `exchange.buyTokens{value: amount}()` on `0xcE3e12bD77DD54E20a18cB1B94667F3E697bea06` with `amount = LCT.balanceOf(exchange)/1e18` to buy LCT cheaply.
4. Approve and swap LCT for WBNB on PancakeSwap router `0x10ED43C718714eb63d5aA57B78B54704E256024E` using `swapExactTokensForETHSupportingFeeOnTransferTokens`.
**How found:** Not stated; likely discovered by analyzing the close-source contract's function selectors and testing calls.
**Exploitation:** Attacker called unprotected functions to become owner and set token price to 1, then bought LCT from the exchange at the manipulated price and sold it on PancakeSwap for BNB, netting ~384 BNB.
**Insight:** For close-source contracts, enumerate function selectors and test calls that modify critical state (ownership, price) for missing access control.