# ADC: missing access control in calcStepIncome drains funds

ADC MainPool's calcStepIncome lacks access control, allowing anyone to inflate a player's stepIncome and withdraw ~20 ETH.

- Payout: Real-world hack
- Severity: high
- Program: ADC
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-02
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/ADC_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240202-adc
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** MainPool contract
**Root cause:** calcStepIncome is externally callable without authorization, letting an attacker set arbitrary stepIncome for any player ID.
**Steps:**
1. Attacker deploys Helper contract with 18 ETH.
2. Helper calls tick.buyADC{value: 3 ether}() to obtain ADC tokens.
3. Helper calls mainpool.joinGame{value: 15 ether}(attacker) to become a player.
4. Helper calls mainpool.calcStepIncome(529, 36099999999999999900, 100) to set stepIncome for player 529 to ~36 ETH.
5. Helper calls mainpool.withdraw() to withdraw inflated balance.
**Exploitation:** Attacker joins the game with 15 ETH, then calls calcStepIncome with a large value to artificially inflate stepIncome, and withdraws the inflated amount, draining ~20 ETH from the pool.
**Insight:** Look for public functions that modify user balances or income without access control, especially in game or staking contracts where such functions should be restricted to internal or admin use.