# Ak1111: missing access control in nonblockingLzReceive1 mints tokens

Ak1111 token on BSC lacked access control on nonblockingLzReceive1, letting anyone mint tokens and swap for 31.5K USD.

- Payout: Real-world hack
- Severity: high
- Program: Ak1111
- Credited: DeFiHackLabs
- Disclosed: 2024-11-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-11/Ak1111_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241123-ak1111
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP20 token contract on BSC
**Root cause:** The nonblockingLzReceive1 function, intended for cross-chain message handling, lacks access control, allowing any caller to mint tokens to an arbitrary address.
**Steps:**
1. Call `ak1111.nonblockingLzReceive1(0, address(this), ak1111Balance, "")` to mint AK1111 tokens equal to the LP balance to the attacker contract.
2. Approve PancakeRouter to spend the minted AK1111 tokens.
3. Swap the minted AK1111 tokens for BSC_USD via PancakeRouter using `swapExactTokensForTokensSupportingFeeOnTransferTokens`.
**Exploitation:** Attacker called the unprotected nonblockingLzReceive1 to mint AK1111 tokens matching the Pancake LP balance, then swapped them for BSC_USD on PancakeSwap, draining ~31.5K USD.
**Insight:** Cross-chain receive functions (e.g., nonblockingLzReceive) must verify the caller is the authorized endpoint and that the source chain/address are trusted; missing checks allow arbitrary minting.