# BNBX: allowance-draining function lets attacker steal approved tokens

BNBX contract's public function let anyone pull approved BNBX from victims' wallets via allowance, drained and swapped for ~75 BNB.

- Payout: Real-world hack
- Severity: medium
- Program: BNBX
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/BNBX_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240427-bnbx
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BNBX token contract on BSC (0x389a...1c24)
**Root cause:** A callable function (selector 0x11834d4c) on the BNBX contract transfers tokens from an arbitrary address using the caller-supplied victim's allowance without proper authorization, so anyone can spend victims' approvals.
**Steps:**
1. Fork BSC at block 38230509-1.
2. Enumerate victim addresses with nonzero BNBX allowance to contract 0x389A9AE29fbE53cca7bC8B7a4d9D0a04078e1C24.
3. For each victim call `BNBX_0x389a.call(abi.encodeWithSelector(bytes4(0x11834d4c), victim))` to pull their approved BNBX.
4. Transfer drained BNBX into WBNB/BNBX Pancake LP and call `swap(amountOut,0,attacker,"")` to extract WBNB.
**Exploitation:** Attacker calls the vulnerable function per victim to spend each victim's existing BNBX allowance, accumulating BNBX, then dumps it into the WBNB/BNBX PancakeSwap pair via swap to extract ~75 BNB (~5 ETH) of value.
**Insight:** Look for token contracts exposing functions that spend a third party's allowance (transferFrom-style) without checking msg.sender is the owner or an authorized spender; enumerate approvals to the contract to find drainable victims.