# Polygon Lack Of Balance Check Bugfix Review — $2.2m Bounty

MRC20 transferWithSig lacked a zero-address check on ecrecovery and balance check in _transfer, letting anyone forge a transfer and drain ~9.27B MATIC.

- Payout: $2,200,000
- Severity: critical
- Program: Polygon
- Credited: Leon Spacewalker
- Disclosed: 2021-12-29
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/polygon-lack-of-balance-check-bugfix-review-2-2m-bounty/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-polygon-lack-of-balance-check-bugfix-review-2-2m-bounty
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:signature-replay

**Target:** MRC20 token contract transferWithSig/_transferFrom
**Root cause:** transferWithSig calls _transferFrom without verifying ecrecovery returned a nonzero address, and _transferFrom/_transfer skip balance/allowance checks, so an invalid signature yields from=0x0 and arbitrary transfers from the contract.
**Steps:**
1. Craft a packed signature byte string of length != 65 so ecrecovery returns the zero address.
2. Call `transferWithSig` with that invalid signature, `amount` = full MRC20 contract balance, `to` = attacker address.
3. from recovers as 0x0; _transferFrom calls _transfer without balance check.
4.  _transfer only checks recipient != MRC20 contract and moves the amount to attacker.
5. Attacker receives all MATIC held by the contract.
**Exploitation:** Attacker submits a transferWithSig transaction with a malformed (<65 byte) signature, amount equal to the contract's full balance, and their own address as recipient; no valid signature or balance is required, so the contract transfers its entire MATIC balance to the attacker. A blackhat actually stole 801,601 MATIC this way before the fix.
**Insight:** When a contract recovers a signer via ecrecover/ecrecovery, always check the result is nonzero and matches an expected owner; malformed signatures of wrong length silently return address(0), which can become a privileged 'from' in unchecked transfer paths.