# MEVbot: missing access control drains $2M via router

MEVbot router lacked access control on a swap function, letting an attacker drain ~$2M in tokens via flash-loan-funded swaps.

- Payout: Real-world hack
- Severity: critical
- Program: MEVbot
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-07
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/bot_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231107-bot
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** MEVbot router contract (0x05f0...24a5)
**Root cause:** The router contract exposed a swap-like function (selector 0xf6ebebbb) without access control, allowing anyone to call it and swap tokens held by the contract.
**Steps:**
1. Flash loan 27,255 WETH from Aave.
2. Call router with selector `0xf6ebebbb` to swap USDC held by router to USDT via Curve pool 0xbEbc...F1C7.
3. Call router again to swap USDT to WETH via Curve pool 0xD51a...AE46.
4. Call router again to swap WBTC to WETH via same Curve pool.
5. Swap WETH to WBTC via Curve pool 0xD51a...AE46.
6. Call router to swap WETH to WBTC via Curve pool.
7. Swap WBTC back to WETH via Curve pool.
8. Repay flash loan and keep remaining WETH.
**Exploitation:** Attacker flash-loaned WETH, then repeatedly called the unprotected router function to swap the router's token balances (USDC, USDT, WBTC) into WETH, and used Curve exchanges to convert WETH to WBTC and back, ultimately draining ~$2M in WETH.
**Insight:** MEV bots and routers often hold token balances and expose swap functions; check for missing access control on any function that moves funds, especially those with arbitrary token parameters.