# ABCCApp: missing access control in addFixedDay enables DDDD drain

ABCCApp's addFixedDay lacked access control, letting an attacker set a huge fixed-day value and claim excessive DDDD tokens, draining ~$10.1K.

- Payout: Real-world hack
- Severity: high
- Program: ABCCApp
- Credited: DeFiHackLabs
- Disclosed: 2025-08-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/ABCCApp_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250823-abccapp
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** BSC smart contract (ABCCApp token staking/claim contract)
**Root cause:** The addFixedDay function has no access control, allowing any caller to arbitrarily increase the fixed-day parameter used in reward calculation for claimDDDD.
**Steps:**
1. Flash loan 12,500 BUSD from ERC1967Proxy (Moolah) via `flashLoan(BSC_USD, 12500000000000000000000, "")`.
2. In callback, approve BUSD to ABCCApp and call `deposit(125, address(0))`.
3. Call `addFixedDay(1000000000)` to inflate the fixed-day value without authorization.
4. Call `claimDDDD()` to receive DDDD tokens based on inflated parameter.
5. Swap received DDDD tokens to BUSD via PancakeSwap V3 exactInput path DDDD->WBNB->BUSD.
6. Repay flash loan and transfer remaining BUSD to attacker.
**Exploitation:** Attacker flash-loaned 12,500 BUSD, deposited minimal amount, called unprotected addFixedDay to set a huge value, claimed DDDD tokens, swapped them for BUSD on PancakeSwap, repaid loan, and kept ~10,062 BUSD profit.
**Insight:** Look for state-mutating functions that adjust reward multipliers or time parameters without access control; even a small deposit can be amplified by directly setting the multiplier.