# Pledge: missing access control in swapTokenU drains MFT

Pledge's swapTokenU lacked access control, letting anyone drain all MFT tokens held by the contract to an arbitrary address.

- Payout: Real-world hack
- Severity: high
- Program: Pledge
- Credited: DeFiHackLabs
- Disclosed: 2024-12-03
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-12/Pledge_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241203-pledge
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control

**Target:** BSC smart contract (Pledge) swapTokenU function
**Root cause:** The swapTokenU function is externally callable with no access control, allowing any caller to specify an arbitrary _target and amount to transfer out the contract's token balance.
**Steps:**
1. Identify vulnerable contract `0x061944c0f3c2d7dabafb50813efb05c4e0c952e1` on BSC.
2. Read MFT balance of the contract: `IERC20(MFT).balanceOf(pledge)`.
3. Call `IPledge(pledge).swapTokenU(amount, address(this))` with the full balance and attacker address as target.
4. Receive all MFT tokens at attacker address.
**Exploitation:** Attacker called swapTokenU with the contract's entire MFT balance and their own address as _target, transferring all MFT out in a single transaction.
**Insight:** When auditing DeFi contracts, check any function that transfers tokens to a caller-supplied address for missing access control; a single unguarded swap/withdraw function can drain the entire balance.