# USDTStakingContract28: unauthenticated tokenAllowAll drains staked USDT

USDTStakingContract28's unprotected tokenAllowAll let anyone approve themselves and transferFrom the contract's entire USDT balance (~$21k).

- Payout: Real-world hack
- Severity: high
- Program: USDTStakingContract28
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/USDTStakingContract28_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230715-usdtstakingcontract28
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control

**Target:** Solidity staking contract on Ethereum mainnet
**Root cause:** tokenAllowAll(address asset, address allowee) is externally callable with no access control, letting any caller grant themselves an allowance on the contract's tokens.
**Steps:**
1. Call `Stake.tokenAllowAll(address(USDT), address(this))` on 0x800cfD4A2ba8CE93eA2cc814Fce26c3635169017 to approve attacker contract for USDT.
2. Call USDT `transferFrom(address(Stake), attacker, USDT.balanceOf(address(Stake)))` via selector `0x23b872dd` to sweep the full balance.
**Exploitation:** Attacker contract invoked the unprotected tokenAllowAll to self-approve, then used USDT transferFrom to move the staking contract's entire USDT balance to the attacker; ~$20,999 lost.
**Insight:** Staking/reward contracts often expose helper functions like tokenAllowAll or rescue/approve routines; check every external function that sets allowances or moves tokens for missing onlyOwner/access modifiers.