# BITDOG: public changeRouterVersion enables fake router BNB drain

BITDOG token's changeRouterVersion lacked onlyOwner, letting attacker set fake router and drain 2.10 BNB via swapAndLiquify.

- Payout: Real-world hack
- Severity: high
- Program: bitdog
- Credited: DeFiHackLabs
- Disclosed: 2025-04-27
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/bitdog_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250427-bitdog
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BEP20 token contract with swapAndLiquify and router setter
**Root cause:** changeRouterVersion is public; the intended onlyOwner restriction is only a comment. The token trusts the router/pair addresses for swap and liquidity operations.
**Steps:**
1. Deploy MaliciousBITDOGRouter with token and profit receiver.
2. Call `IBITDOG(BITDOG_TOKEN).changeRouterVersion(0, address(fakeRouter))` to set fake router/pair.
3. Call `bitdog.transfer(address(fakeRouter), 0)` to trigger swapAndLiquify (token balance already exceeds minimumTokensBeforeSwapAmount).
4. Fake router's swapExactTokensForETHSupportingFeeOnTransferTokens does nothing; BITDOG treats its pre-existing BNB balance as swap proceeds.
5. BITDOG sends BNB to fake addLiquidityETH, which forwards msg.value to attacker.
**How found:** Likely source review revealed changeRouterVersion was public despite comment indicating onlyOwner, and swapAndLiquify logic trusted router return values and contract balance.
**Exploitation:** Attacker replaced router/pair with attacker-controlled contract, triggered swapAndLiquify with zero-amount transfer. Fake router performed no swap, so BITDOG treated its pre-existing BNB balance as swap proceeds and sent that balance to fake addLiquidityETH, which forwarded it to the attacker. Total 2.10 BNB drained.
**Insight:** Check token contracts for public router/pair setters that are only protected by comments; then see if swapAndLiquify or similar functions use contract balance as swap output, allowing fake router to redirect funds.