# Infinite approval to an arbitrary address can be used to steal all the funds from the contract

AnyswapFacet grants infinite ERC20 approval to a caller-supplied router address, letting an attacker deploy a fake router and transferFrom all funds held by the LI.FI diamond.

- Payout: Audit contest
- Severity: medium
- Program: LI.FI
- Found by: WatchPug
- Disclosed: 2022-05-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-lifinance-findings/issues/160
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-lifinance%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AnyswapFacet._startBridge / LibAsset.approveERC20 (Solidity diamond facet)
**Root cause:** The router address comes from user calldata and is never whitelisted; LibAsset.approveERC20 then sets MAX_INT allowance to that arbitrary spender instead of the exact amount.
**Steps:**
1. Deploy a fake router contract implementing the IAnyswapRouter interface (wNATIVE, anySwapOutUnderlying, etc.).
2. Call `startBridgeTokensViaAnyswap()` with `_anyswapData.router` set to the fake router and a token whose `underlying()` returns a real ERC20 held by the diamond.
3. The facet calls `LibAsset.approveERC20(underlyingToken, fakeRouter, amount)`, which sets allowance to MAX_INT.
4. From the fake router, call `transferFrom(diamond, attacker, balance)` to drain all held tokens.
**How found:** Code review of AnyswapFacet traced `_anyswapData.router` from calldata into `LibAsset.approveERC20`, noticing the spender is unvalidated and the approval is MAX_INT rather than the transaction amount.
**Exploitation:** Attacker needs no capital: a single bridge call with a malicious router grants unlimited allowance, then the fake router pulls every ERC20 balance sitting in the diamond contract.
**Insight:** In diamond/facet architectures, trace every calldata-supplied address that reaches an approval or call target; infinite approvals to unwhitelisted spenders turn any residual contract balance into a theft primitive.