# GROKD: missing access control in updatePool drains rewards

GROKD staking contract lacked access control on updatePool, letting attacker set huge rewardPerBlock and drain ~150 BNB.

- Payout: Real-world hack
- Severity: high
- Program: GROKD
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-12
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/GROKD_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240412-grokd
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BSC staking/deposit contract
**Root cause:** updatePool(uint256, PoolInfo) is externally callable with no access control, allowing anyone to overwrite pool reward parameters.
**Steps:**
1. Acquire LP tokens via swap + addLiquidity on PancakeSwap.
2. Call `depositor.depositFromIDO(address(this), lpAmount)` to register stake.
3. Call `depositor.updatePool(0, PoolInfo({startBlock:0, endBlock:block.number+100000000, rewardPerBlock:48000000 ether}))` to inflate rewards.
4. Advance one block and call `depositor.update()` then `depositor.reward()`.
5. Swap earned GROKD to WBNB and withdraw.
**How found:** Likely source review spotting public updatePool with no onlyOwner modifier, then testing parameter overwrite to inflate rewards.
**Exploitation:** Attacker staked minimal LP, overwrote pool params via unauthenticated updatePool, triggered reward accrual for one block at inflated rate, claimed and swapped tokens for ~150 BNB.
**Insight:** In staking/farming contracts, check every function that writes pool parameters (rewardPerBlock, start/endBlock) for missing access control; a single unauthenticated setter can mint arbitrary rewards.