# Shell MEV bot: missing access control drains BUSD

Shell MEV bot's unprotected swap function allowed anyone to drain BUSD from victim contracts by calling with arbitrary parameters.

- Payout: Real-world hack
- Severity: medium
- Program: Shell_MEV_0xa898
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/Shell_MEV_0xa898_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240115-shell-mev-0xa898
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium technique:source-review vuln:access-control vuln:business-logic

**Target:** MEV bot smart contract on BSC
**Root cause:** The vulnerable contract (Robot1) exposed a function (selector 0x5f90d725) that performed token swaps without verifying the caller, allowing arbitrary users to specify victim addresses and amounts.
**Steps:**
1. Identify Robot1 contract at 0xa898b78B7cbBabacf9d179C4C46c212c0aC66F46 with a public function selector 0x5f90d725.
2. Call Robot1 with arguments: Victim2, Victim1, attacker address, BUSD.balanceOf(Victim1), 100, 360.
3. Repeat while Victim1's BUSD balance > 10e18.
4. Similarly call Robot2 (0x923AA7C73909b21CF0854904dF2fA2394087f818) with Victim2 as both source and destination to drain Victim2.
5. Swap accumulated SHELL tokens to BUSD via PancakeSwap.
**How found:** Likely discovered by inspecting the MEV bot's contract for publicly callable functions that lacked access control, then testing with victim addresses.
**Exploitation:** Attacker repeatedly invoked the unprotected function on two MEV bot contracts, passing victim addresses and their BUSD balances as parameters, causing the bots to transfer BUSD to the attacker. The attacker then converted received SHELL tokens to BUSD.
**Insight:** MEV bots often have public functions for arbitrage; check if they allow arbitrary 'from' and 'to' addresses without authentication, enabling theft of approved funds.