# GMT7 helper: public functions drain BNB and token balances

Unverified GMT7 helper exposed public transferBnb/buyTokenAmount/robotSell2me functions, letting attacker drain its BNB and sell its GMT7 for 16.75 BNB.

- Payout: Real-world hack
- Severity: high
- Program: GMT7
- Credited: DeFiHackLabs
- Disclosed: 2025-02-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/GMT7_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250208-gmt7
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** BSC GMT7 helper contract with router approvals and token balances
**Root cause:** The unverified helper contract exposed state-changing trading and BNB-transfer functions (transferBnb, buyTokenAmount, robotSell2me) with no access control, so anyone could direct its funds and sell its GMT7 holdings.
**Steps:**
1. Fork BSC at block 46497384.
2. Call `helper.transferBnb([attackContract])` to sweep the helper's BNB.
3. Call `helper.buyTokenAmount(3023)` to force the helper to buy GMT7.
4. Loop 44x `helper.robotSell2me(100)` then `helper.robotSell2me(58)` to sell helper's GMT7 to the GMT7/USDT pair, routing USDT to attacker.
5. Approve and swap USDT to WBNB via Pancake router `swapExactTokensForETHSupportingFeeOnTransferTokens`.
6. Assert profit > 16 BNB.
**How found:** Attacker likely noticed the helper contract was unverified and held token balances plus router approvals, and that its trading functions (buyTokenAmount, robotSell2me, transferBnb) lacked access control, allowing anyone to drive its trades and redirect proceeds.
**Exploitation:** Attacker called the helper's unauthenticated functions directly: transferBnb to extract BNB, buyTokenAmount to load GMT7, then repeated robotSell2me calls to dump the helper's GMT7 into the GMT7/USDT pair with USDT output sent to the attack contract; converted USDT to BNB via Pancake.
**Insight:** Unverified helper/robot contracts holding balances and router approvals are prime targets: enumerate their external functions and check whether buy/sell/transfer helpers accept arbitrary callers and arbitrary recipient addresses.