# MEVBot 0xa247: missing access control drains victim tokens

MEV bot contracts lacked access control on admin functions, letting an attacker call removeAdmin and withdrawToken to drain ~$150K in tokens from 24 victims.

- Payout: Real-world hack
- Severity: high
- Program: MEVBot_0xa247
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-12
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/MEV_0xa247_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231112-mev-0xa247
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** MEV bot smart contracts on Ethereum
**Root cause:** Admin functions (removeAdmin, withdrawToken) on MEV bot contracts were callable by anyone without authorization checks, allowing arbitrary token withdrawal.
**Steps:**
1. Fork mainnet at block 18552866.
2. For each victim contract and associated token, call `victim.call(abi.encodeWithSelector(0xe7d25975, address(this), address(this), tokenAddr, [address(this)], 4, 3, 2, 0, 0))` to remove admin.
3. Call `victim.call(abi.encodeWithSelector(0x4abe11b4))`, then `0xd547557b`, then `0x90fb9dca` with tokenAddr and 0 to withdraw tokens.
4. Swap withdrawn tokens to WETH via Uniswap V2 Router.
**Exploitation:** Attacker called unprotected admin functions on 24 MEV bot contracts to remove existing admins and withdraw all token balances, then swapped tokens to WETH for profit.
**Insight:** MEV bot contracts often expose admin functions without access control; check for unprotected selectors like removeAdmin/withdrawToken on similar bots.