# BitCrown: unprotected distributor function drains 100k tokens

BitCrown distributor's unprotected batch-transfer function let an attacker drain 100,000 BITCROWN tokens and sell them for ~$7,939 USDT.

- Payout: Real-world hack
- Severity: high
- Program: BitCrown
- Credited: DeFiHackLabs
- Disclosed: 2025-06-09
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/BitCrown_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250609-bitcrown
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** BitCrown distributor contract on BSC
**Root cause:** The distributor contract exposed an unverified function (selector 0x1239ec8c) that allowed any caller to specify token, recipients, and amounts to transfer from the distributor's own token balance.
**Steps:**
1. Deploy a helper contract whose constructor calls the distributor at `0x93b621a9f8f1821a6a693a29672ca3d6612a2a7e` with selector `0x1239ec8c`, passing BITCROWN token address, an array containing the helper's address, and amount `100000 ether`.
2. The distributor transfers 100,000 BITCROWN to the helper.
3. Helper approves PancakeSwap router and swaps all BITCROWN for USDT via `swapExactTokensForTokensSupportingFeeOnTransferTokens`, sending USDT to the attacker.
**Exploitation:** Attacker deployed a constructor-only helper that called the unprotected distributor function to transfer 100,000 BITCROWN to itself, then sold them on PancakeSwap for USDT, netting ~$7,939.
**Insight:** Unverified functions in distributor contracts can hide arbitrary transfer logic; fuzz selectors on contracts holding token balances to find unprotected batch-transfer entrypoints.