# Unverified BSC contract: missing access control drains tokens

Unverified BSC contract lacked access control on selector 0x88417d5c, letting any caller drain its USDT, aBnbETH, and HODL tokens.

- Payout: Real-world hack
- Severity: high
- Program: Unverified_0000
- Credited: DeFiHackLabs
- Disclosed: 2025-05-25
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/unverified_0000_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250525-unverified-0000
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control

**Target:** BSC smart contract (unverified)
**Root cause:** Missing access control on the token-drain function selector 0x88417d5c; owner/storage-owner checks are not applied.
**Steps:**
1. Identify vulnerable contract `0x000004A70f92f1B22de1201aF76C48365D5D0000` on BSC.
2. Call selector `0x88417d5c` with arguments `(0,0,0, entries)` where entries is an array of `{token, amount}` structs.
3. For each token (USDT, aBnbETH, HODL), set amount to victim's full balance.
4. The contract transfers the specified token amounts to msg.sender.
**Exploitation:** Attacker calls the unprotected drain function with an array of token/amount pairs, causing the victim contract to transfer its entire balances of USDT, aBnbETH, and HODL to the attacker.
**Insight:** Unverified contracts with arbitrary-call-like selectors should be probed for missing access control by testing state-changing functions from a non-owner address; selectors that accept token/amount arrays are prime candidates for drain paths.