# MyCoinMaster: unauthenticated buyBYAdmin mints MYC redeemable for USDT

MyCoinMaster's buyBYAdmin lacked access control, letting anyone mint MYC and redeem it for USDT via swap(), draining 653 USD.

- Payout: Real-world hack
- Severity: high
- Program: MyCoinMaster
- Credited: DeFiHackLabs
- Disclosed: 2025-08-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/MyCoinMaster_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250805-mycoinmaster
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BSC smart contract (MycoinmasterV7 proxy) with buyBYAdmin and swap functions
**Root cause:** buyBYAdmin(uint256,address,address) has no admin/access check, allowing arbitrary callers to mint MYC; swap() then redeems MYC for USDT directly from the contract's balance.
**Steps:**
1. Call `buyBYAdmin(100_000_000_000_000, address(this), address(this))` on MyCoinMaster to mint MYC to the attacker contract.
2. Approve MyCoinMaster to spend MYC: `IERC20(MYC).approve(MYCOINMASTER, 120_225_946_717)`.
3. Call `swap(120_225_946_717)` to redeem MYC for USDT from the victim contract.
4. Withdraw 653.63 USDT profit; victim contract loses equivalent USDT.
**Exploitation:** Attacker called the unprotected buyBYAdmin to mint a large locked MYC position to the victim contract plus a 1% MYC airdrop to the attack contract, then called swap() which accepted the airdropped MYC and paid out USDT held by the victim contract.
**Insight:** Look for mint/buy functions named like admin-only (buyBYAdmin) that lack modifiers; then check whether the minted token can be immediately redeemed for a real asset via a swap function that trusts caller-supplied token amounts.