# Babyloogn airdrop: missing validation enables repeated claims

Babyloogn airdrop contract lacked validation, allowing repeated claims of 285 tokens via a loop, draining ~2.24 WBNB.

- Payout: Real-world hack
- Severity: high
- Program: Babyloogn
- Analysis by: DeFiHackLabs
- Disclosed: 2024-02-15
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-02/Babyloogn_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240215-babyloogn
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Airdrop contract on BSC
**Root cause:** The airdrop contract's claim function (selector 0xfbe81135) did not validate whether the caller had already claimed or was eligible, allowing repeated claims.
**Steps:**
1. Attacker calls `Babyloogn.approve(Router, max)` and `BabyloognNFT.setApprovalForAll(Airdrop, true)`.
2. While `Babyloogn.balanceOf(Airdrop) >= 285e18`, call `Airdrop.call(0xfbe81135, 1, 0)` repeatedly to claim 285 tokens each time.
3. Swap all claimed Babyloogn tokens for WBNB via PancakeRouter using `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**Exploitation:** Attacker repeatedly called the airdrop claim function to drain the airdrop contract's token balance, then sold the tokens on PancakeSwap for ~2.24 WBNB.
**Insight:** Airdrop claim functions must verify eligibility and prevent multiple claims; check for missing state updates or signature validation in claim logic.