# exactInput allows stealing of funds via a malicious pool contract

Maverick Router.exactInput calls any pool address from the user-supplied path without verifying it was factory-created, letting a malicious pool drain user funds.

- Payout: Audit contest
- Severity: medium
- Program: Maverick
- Found by: Jeiwan
- Disclosed: 2023-05-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-12-stealth-project#m-04
- Library page: http://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Router.sol exactInput swap path handling
**Root cause:** exactInput iterates the encoded path and calls pool.swap on each pool address without checking factory.isFactoryPool, so an attacker-controlled contract can be inserted as a pool.
**Steps:**
1. Deploy malicious contract implementing swap(recipient, amount, tokenAIn, exactOutput, sqrtPriceLimit, data).
2. In swap, call `IRouter(msg.sender).sweepToken(IERC20(tokenAddress), 0, address(this))` to pull tokens from the Router, then return amountOut = type(uint256).max.
3. Build path `encodePath([weth9.address, poolWETHB, tokenB.address, exploit.address, tokenA.address])` injecting the exploit as a pool.
4. Call `router.exactInput({path, recipient: owner, deadline, amountIn: 1e18, amountOutMinimum: 0})`.
5. Router calls the malicious pool's swap, which sweeps tokenB from the Router; user spends WETH but receives nothing.
**How found:** Code review of Router.exactInput: noticed the path is user/front-end supplied and each pool address is called directly with no factory validation, unlike Uniswap V3's router.
**Exploitation:** Attacker tricks a user (e.g. via a malicious front-end that builds the path) into calling the official Router with a path containing the attacker's contract as a pool; the contract's swap callback sweeps tokens held by the Router to the attacker.
**Insight:** When a router trusts a user-supplied path of pool addresses, check whether each pool is validated against the factory; Uniswap V3 does this, so compare router path handling across DEX forks for missing isFactoryPool checks.