DEX router drain — unverified V3 callback trusts a fake pool and `transferFrom`s any approver

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-09-RouterDrain_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/RouterDrain_exp.sol.

Vulnerability classes: vuln/access-control/missing-auth · vuln/input-validation/missing · vuln/logic/missing-check

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/RouterDrain_exp.sol.

Key info#

TL;DR#

The router exposes a permissionless swap entry (selector 0x33411b5e). Routes carry an attacker-chosen pool. The router calls pool.swap(0x128acb08) without checking that pool is factory-derived. factoryV3() is the zero address, so no legitimate pool address could even be recomputed.

A fake contract that only implements swap() re-enters router.uniswapV3SwapCallback(int256,int256,bytes)=0xfa461e33. The callback decodes a payer from the echoed data and does transferFrom(payer, msg.sender, amount) — binding neither msg.sender to a real pool nor payer to the original swap initiator. The fake pool names the victim as payer. Anyone who ever approved the router is drainable.

This PoC models three victims (standing max approval granted via prank), seeds a tiny balance so the router's balanceOf(recipient) >= amountIn gate passes, and loops until each victim is empty. Original tx bootstrapped with a 1 WBNB PancakeV2 flash-swap and dumped loot to WBNB; those are monetisation, omitted here.

Background#

Aggregator routers that speak Uniswap V3 typically:

1. Verify msg.sender of the callback is Factory.getPool(tokenA, tokenB, fee) (or a cached allowlist).
2. Pull tokens from the swap initiator, not from an arbitrary payer in callback data.

This router does neither, and ships with factoryV3 == 0x0.

The vulnerable code#

RECONSTRUCTED from the trace (router unverified). Confirmed on-chain: factoryV3() returns address(0) at the fork.

function factoryV3() external view returns (address); // == 0

// selector 0x33411b5e — permissionless
// Route { kind, tokenIn, tokenOut, pool, fee, a, b, data }
// router calls pool.swap(...) with no factory check

function uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes calldata data) external {
    PayInfo memory info = abi.decode(data, (PayInfo)); // {path, payer, recipient, amount}
    // NO: require(msg.sender == Factory.getPool(...))
    // NO: require(info.payer == originalInitiator)
    IERC20(tokenIn).transferFrom(info.payer, msg.sender, info.amount);
}

Root cause#

1. Zero factory → callback cannot authenticate a pool.
2. Attacker-chosen pool in the route.
3. Callback-supplied payer replaces the initiator.
4. Standing user approvals to the router are a hot wallet for this path.

No price manipulation, no oracle, no privilege.

Preconditions#

• Victim holds a token balance and has approve(router, max) (or any remaining allowance).
• Attacker holds a seed of that token (real tx: flash-swap ~1 WBNB into the token) because the router gates on balanceOf(recipient) >= amountIn without spending the recipient's tokens.

Attack walkthrough#

Victims in this PoC (full balances stolen):

Loop: amountIn = min(victimBal, attackerHoldings) (doubles each iteration until empty).

[PASS] testExploit()

Each victim's token balance is 0; attacker FakePool/orchestrator holds the stolen amount minus the dealt seed.

Diagrams#

Remediation#

1. Set factoryV3 to the real Pancake/Uni V3 factory and require(msg.sender == factory.getPool(token0, token1, fee)) in the callback.
2. Ignore callback payer. Always pull from the original swap initiator (or a permit the initiator signed).
3. Allowlist pools; never take pool from user calldata without verification.
4. Users: revoke approvals to 0xa331fde0…0d24.

How to reproduce#

_shared/run_poc.sh 2026-09-RouterDrain_exp --mt testExploit -vvvvv

Fork is BSC (127.0.0.1:8546). Expected: [PASS] testExploit() with each of the three victims fully drained.

Reference: https://x.com/exvulsec/status/2097004102240842230

References#

• https://x.com/SlowMist_Team/status/2097153762746159228 (@SlowMist_Team secondary analysis)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-RouterDrain_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: RouterDrain_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "DEX router drain".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.