# Public to all funds escape

LooksRareAggregator's execute() returns full contract token/ETH balances to msg.sender, letting anyone drain funds meant for owner rescue.

- Payout: Audit contest
- Severity: medium
- Program: LooksRare
- Found by: V_B
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-11-looksrare#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-looksrare%3AM-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LooksRareAggregator / ERC20EnabledLooksRareAggregator execute()
**Root cause:** _returnERC20TokensIfAny and _returnETHIfAny refund the entire contract balance to msg.sender instead of only the amount deposited, so any caller can sweep stuck funds.
**Steps:**
1. Call execute() on ERC20EnabledLooksRareAggregator with tokenTransfers listing tokens held by the contract.
2. After order execution, _returnERC20TokensIfAny and _returnETHIfAny run.
3. Full ERC20 and ETH balances are transferred to msg.sender.
**How found:** Code review of rescue functions and the execute refund path; noticed refunds return whole balance rather than deposited amount.
**Exploitation:** Attacker front-runs the owner's rescueETH/rescueERC20 calls by invoking execute() with the target token addresses, receiving the entire stuck balance.
**Insight:** When a contract has owner-only rescue functions, check whether any user-callable path refunds the contract's full balance to msg.sender, enabling front-running of rescues.