# DAO_SoulMate: missing access control in redeem drains funds

DAO_SoulMate's redeem() lacked access control, letting anyone burn the contract's BUI balance and drain ~$319K in tokens.

- Payout: Real-world hack
- Severity: high
- Program: DAO_SoulMate
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-22
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/DAO_SoulMate_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240122-dao-soulmate
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** SoulMate redeem() function on Ethereum mainnet
**Root cause:** The redeem(uint256 _shares, address _receiver) function had no access control or caller validation, allowing any address to redeem shares held by the contract.
**Steps:**
1. Fork Ethereum mainnet at block 19063676.
2. Call `SoulMateContract.redeem(BUI.balanceOf(address(SoulMateContract)), address(this))` from attacker contract.
3. Contract transfers its entire BUI balance worth of underlying tokens (USDC, DAI, MATIC, AAVE, ENS, ZRX, UNI) to attacker.
**Exploitation:** Attacker called redeem() with the contract's full BUI balance as _shares and their own address as _receiver, causing the contract to release all underlying assets to the attacker without any authorization check.
**Insight:** When auditing DeFi contracts, check every function that transfers tokens or burns shares for missing caller validation—especially redeem/withdraw functions that accept arbitrary _receiver addresses.