# User can bypass entryFee by sending arbitrary calldata to ParaSwap operator

NestedFactory charges entryFee on swap input amount; attacker swaps 1 wei via ParaSwap to an ERC777 they control, then transfers large USDC directly to the factory, paying zero fee.

- Payout: Audit contest
- Severity: medium
- Program: Nested Finance
- Found by: 0xDjango
- Disclosed: 2022-09-22
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2022-06-nested#m-01
- Library page: http://bugbountylibrary.com/r/c4%3A2022-06-nested%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:fee-bypass

**Target:** NestedFactory.create() / ParaswapOperator swap operator
**Root cause:** entryFee is computed on the swap's inputToken amount rather than the tokens actually entering the Reserve; the operator trusts the Order's declared buy token balance delta while the user controls arbitrary calldata and can regain execution via ERC777 callback to transfer tokens directly.
**Steps:**
1. Call `NestedFactory.create()` with a single order: inputToken=address(0) ETH, amount=1 wei, Order(operator=Paraswap, token=USDC, calldata=attacker calldata).
2. Craft calldata that swaps ETH to an ERC777 (not USDC) with the attacker's attack contract as beneficiary.
3. On ERC777 receipt, the attack contract sends e.g. 1,000,000 USDC directly to the Nested Factory.
4. ParaswapOperator checks USDC balance delta (the Order token), seeing 1,000,000 USDC received for 1 wei ETH.
5. NestedFactory deposits the USDC to the vault; entryFee computed on 1 wei input rounds to 0.
**How found:** Observed that the operator verifies the Order's declared buy-token balance rather than the actual swap output, and that arbitrary user calldata plus ERC777 transfer callbacks give the attacker execution control mid-swap; combined with fee computed on input amount, precision loss on 1 wei zeroes the fee.
**Exploitation:** Attacker needs only 1 wei of input token plus their own USDC. Arbitrary calldata to ParaSwap routes the swap to an attacker-controlled ERC777, whose transfer callback hands control back to the attacker, who then transfers the real output token (USDC) directly to the factory. The operator's balance check on the declared buy token passes, and the fee is computed on the tiny input amount, yielding zero.
**Escalation:** Judge noted the same bypass applies to other operators (e.g. 0x), to exitFees, and can use a malicious self-deployed ERC20 instead of ERC777.
**Insight:** When a contract charges fees on a user-declared input amount but verifies value via balance deltas of a separately declared token, decouple the two: route the swap to a token you control with a callback (ERC777 or malicious ERC20), then push the real token directly to the contract so the balance check passes while the fee base stays tiny.