# AIS: missing access control on setSwapPairs and harvestMarket

AIS token's setSwapPairs and harvestMarket lacked access control, letting attacker manipulate swap pairs and drain ~$61k via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: AIS
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-29
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/AIS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231129-ais
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:chained vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract and associated vulnerable contract on BSC
**Root cause:** The AIS token contract's setSwapPairs and harvestMarket functions were publicly callable without authorization, allowing anyone to alter swap pair settings and trigger market harvesting. Additionally, a vulnerable contract allowed arbitrary setAdmin and transferToken calls.
**Steps:**
1. Flash loan 3,000,000 USDT from PancakeSwap V3 pool `0x4f31Fa980a675570939B737Ebdde0471a4Be40Eb`.
2. Swap USDT to AIS via PancakeSwap router `0x10ED43C718714eb63d5aA57B78B54704E256024E`.
3. Call `usdt_ais.skim(address(this))` to manipulate reserves.
4. Loop 100 times: transfer 90% of AIS balance to pair, transfer 0, then call `skim` twice to inflate AIS balance.
5. Call `AIS.harvestMarket()` to trigger reward harvesting.
6. Call `vulContract.setAdmin(address(this))` to become admin of vulnerable contract `0xFFAc2Ed69D61CF4a92347dCd394D36E32443D9d7`.
7. Call `vulContract.transferToken(address(AIS), address(this), amount)` to drain 90% of AIS held by vulnerable contract.
8. Call `AIS.setSwapPairs(address(this))` to set swap pairs to attacker-controlled address.
9. Transfer all AIS to pair, then swap AIS back to USDT.
10. Repay flash loan 3,000,000 USDT plus fee, keeping profit (~$61k).
**Exploitation:** Attacker used a flash loan to obtain 3M USDT, swapped to AIS, manipulated the AIS/USDT pair via skim and repeated transfers to inflate AIS balance, then called harvestMarket and setAdmin on a vulnerable contract to drain its AIS holdings, finally swapping AIS back to USDT for profit.
**Escalation:** Chained multiple vulnerabilities: missing access control on setSwapPairs and harvestMarket, plus arbitrary setAdmin and transferToken in a separate contract, amplified by flash loan and skim manipulation.
**Insight:** Look for publicly callable functions that modify critical state (e.g., swap pairs, admin roles) without access control; combine with flash loans and skim to manipulate token balances.