# ETHFIN: missing access control in doBuyback enables flash-loan drain

ETHFIN token's doBuyback lacked access control; attacker flash-loaned WBNB, manipulated holder count, triggered buyback to drain ~$1.24K.

- Payout: Real-world hack
- Severity: medium
- Program: ETHFIN
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-29
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/ETHFIN_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240329-ethfin
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm vuln:access-control vuln:business-logic

**Target:** BEP-20 token contract on BSC
**Root cause:** The doBuyback function in the ETHFIN token contract had no access control, allowing anyone to call it and manipulate token swaps.
**Steps:**
1. Transfer 1 token to sequential addresses starting from 0x1F5 until N_holders() > NextBuybackMemberCount().
2. Flash loan 12 WBNB from PancakeV3 pool 0x172fcD41E0913e95784454622d1c3724f546f849.
3. Swap WBNB to EF tokens via router, then skim EF from pair 0x2b73Ee230dB9d7ddB51B859a3B59Ce48eB5aB4D9.
4. Swap WBNB to ETHFIN via pair 0x168FDb7C2d4249485836595c8576D8f2D7c53a46, then skim ETHFIN.
5. Call doBuyback() on ETHFIN contract.
6. Swap remaining WBNB to EF, transfer ETHFIN to pair, skim to pair 0x3544DA62afB297b5cE9DA14845C89b96D376D98C.
7. Swap ETHFIN for WBNB via pair 0x3544DA62afB297b5cE9DA14845C89b96D376D98C.
8. Repay flash loan plus fee and withdraw BNB.
**How found:** Likely identified missing access control on doBuyback by reviewing contract code, then devised flash-loan sequence to exploit price manipulation during buyback.
**Exploitation:** Attacker used a flash loan to obtain WBNB, manipulated the holder count to meet buyback condition, then called doBuyback to trigger token swaps that inflated ETHFIN price, allowing them to sell ETHFIN for more WBNB and repay the loan, netting ~2.13 BNB profit.
**Insight:** Check for public functions that trigger token buybacks or swaps without access control; these can be manipulated with flash loans to distort prices.