# MEVBot 0x8c2d: missing access control drains BUSDT via role designation

MEV bot's assetHarvestingContract lacked access control on designateRole/harvestAssets, letting attacker grant themselves role and drain ~$365K BUSDT via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: MEVBot_0x8c2d
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/MEV_0x8c2d_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231112-mev-0x8c2d
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** BSC smart contract (assetHarvestingContract) with role-based asset harvesting
**Root cause:** The assetHarvestingContract exposed designateRole and harvestAssets functions without access control, allowing any caller to assign a privileged role and then harvest assets from the victim MEV bot.
**Steps:**
1. Flash loan BUSDT from WBNB_BUSDT pair via `swap(BUSDT.balanceOf(victimMevBot), 0, address(this), data)`
2. In pancakeCall callback, approve assetHarvestingContract to spend BUSDT
3. Call `designateRole` (selector `0xac3994ec`) with crafted args including `(time << 96) | ((chain << 64) & 0xffffffff0000000000000000)` and `address(this)` to grant attacker a privileged role
4. Call `harvestAssets` (selector `0x1270d364`) with victimMevBot and attacker address to transfer BUSDT from victim to attacker
5. Repay flash loan and keep remaining BUSDT
**Exploitation:** Attacker flash-loaned BUSDT from a PancakeSwap pair, then in the callback called unprotected designateRole to assign themselves a role, followed by harvestAssets to drain BUSDT from the victim MEV bot, repaid the loan, and kept ~$365K.
**Insight:** MEV bots and asset-harvesting contracts often expose role-designation and harvest functions without access control; check for unprotected selectors like 0xac3994ec and 0x1270d364 that combine time/chainId packing with asset transfers.