# RICE: missing access control enables unauthorized withdraw

RICE protocol on Base lacked access control on registerProtocol/setMasterContractApproval, letting attacker impersonate a user and withdraw ~34.5 WETH worth of RICE tokens.

- Payout: Real-world hack
- Severity: high
- Program: RICE
- Credited: DeFiHackLabs
- Disclosed: 2025-05-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/RICE_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250524-rice
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:auth-bypass

**Target:** DeFi protocol contract on Base (0xcfE0...5563)
**Root cause:** registerProtocol and setMasterContractApproval are callable by anyone, allowing an attacker to register themselves as a master contract and approve arbitrary user withdrawals.
**Steps:**
1. Fork Base at block 30655995
2. Deploy AttackContract
3. Call `registerProtocol()` on 0xcfE0DE4A50C80B434092f87e106DFA40b71A5563
4. Call `setMasterContractApproval(user=0x49876a20bB86714e98A7E4d0a33d85a4011b3455, masterContract=attackContract, true, 0, 0, 0)`
5. Call `withdraw(RICE_TOKEN, user, attackContract, balance, balance)` with balance 22189176505973791717313474
6. Swap RICE to USDT via Uniswap V3 router
7. Swap USDT to WETH via SwapRouter
8. Transfer WETH to attacker
**Exploitation:** Attacker called unauthenticated registerProtocol and setMasterContractApproval to become an approved master contract for a victim user, then invoked withdraw to drain the victim's RICE balance to the attack contract, swapped RICE→USDT→WETH, and sent ~34.5 WETH to the attacker EOA.
**Insight:** On 0x-style / BentoBox-derived protocols, registerProtocol and setMasterContractApproval must be gated; if they are open, anyone can self-approve as a master contract and pull any user's tokens via withdraw.