A call to an arbitrary contract with custom calldata is made in fillZrxQuote(), which means the contract can be an ERC20 token, and the calldata can be transferFrom a previously approved user.
Impact
The wallet balances (for the amount up to the allowance limit) of the tokens that users approved to the contract can be stolen.
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2021-10-tally/blob/c585c214edb58486e0564cb53d87e4831959c08b/contracts/swap/Swap.sol#L200-L212
A call to an arbitrary contract with custom calldata is made in
fillZrxQuote()
, which means the contract can be an ERC20 token, and the calldata can betransferFrom
a previously approved user.Impact
The wallet balances (for the amount up to the allowance limit) of the tokens that users approved to the contract can be stolen.
PoC
Given:
Swap.sol
;The attacker can:
As a result, 1000 WETH will be stolen from Alice and sent to the attacker.
This PoC has been tested on a forking network.
Recommendation
Consider adding a whitelist for
zrxTo
addresses.