# NestedFactory: User can utilise accidentally sent ETH funds via processOutputOrders() / processInputAndOutputOrders()

NestedFactory's unrestricted receive() lets anyone sweep ETH accidentally sent to the contract by crafting an output order with ETH as the input token.

- Payout: Audit contest
- Severity: medium
- Program: Nested Finance
- Found by: GreyArt
- Disclosed: 2022-04-27
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-nested#m-04
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-nested%3AM-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NestedFactory.sol smart contract (processOutputOrders/processInputAndOutputOrders)
**Root cause:** receive() accepts ETH from any sender, and transferInputTokens() treats address(ETH) as a valid input token, depositing the contract's existing ETH balance into WETH without checking msg.value or _fromReserve.
**Steps:**
1. Note NestedFactory.receive() has no sender restriction, so any user can send ETH to the contract.
2. Call `processOutputOrders()` (or `processInputAndOutputOrders()`) with an output order whose input token is `ETH` and amount equal to the factory's ETH balance.
3. transferInputTokens() sees `address(_inputToken) == ETH`, checks `address(this).balance >= _inputTokenAmount`, and calls `weth.deposit{value: _inputTokenAmount}()` using the stray ETH.
4. The attacker receives the resulting WETH/output, capturing the accidentally sent funds.
**How found:** Code review of receive() and transferInputTokens(): noticed receive() lacks a sender check and that ETH is accepted as an input token address, so the contract's own balance can be consumed as if it were the caller's deposit.
**Exploitation:** Attacker monitors the factory's ETH balance, then submits an output order specifying ETH as input token for the full balance; the contract wraps its own ETH via weth.deposit and credits the attacker.
**Insight:** When a contract holds native ETH and also accepts address(ETH) as a token sentinel, check whether internal balance is used to fund deposits without verifying msg.value or the source of funds.