# Bitallx: payout amount mismatch drains USDT via zero totalSendAmount

BitallxPayOut validated allowance/balance against totalSendAmount but not sum(amount[]), letting attacker pass totalSendAmount=0 and drain 2,029 USDT.

- Payout: Real-world hack
- Severity: high
- Program: Bitallx
- Credited: DeFiHackLabs
- Disclosed: 2025-05-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/bitallx_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250516-bitallx
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** BitallxPayOut function on BSC smart contract
**Root cause:** BitallxPayOut checks allowance and balance against totalSendAmount but never verifies that the sum of amount[] is bounded by totalSendAmount, allowing a zero total with arbitrary payout amounts.
**Steps:**
1. Identify victim contract `0xa5f3728767F834C591eE99C8C5854b752F39C385` holding 2,029.47 USDT.
2. Deploy attack contract and read victim USDT balance via `balanceOf`.
3. Call `BitallxPayOut(USDT, [attackContract], [victimBalance], 0)`.
4. Contract transfers victimBalance USDT to attack contract.
5. Transfer USDT from attack contract to profit receiver.
**How found:** Likely code review revealed that the payout function's validation used totalSendAmount instead of the sum of the amount array, enabling a mismatch between checked total and actual transferred sum.
**Exploitation:** Attacker called BitallxPayOut with totalSendAmount=0 and a single payout amount equal to the victim contract's entire USDT balance, causing the function to transfer existing victim funds to the attack contract.
**Insight:** In multi-recipient payout functions, always verify that the sum of individual amounts equals the declared total; a zero total with non-zero amounts is a classic accounting bypass.