# An attacker can steal all RubiconRouter funds

RubiconRouter's maxBuyAllAmount refunds buy_gem instead of pay_gem, letting an attacker with a fake token drain all router-held tokens.

- Payout: Contest reward
- Severity: high
- Program: Rubicon
- Credited: CryptoCraze
- Disclosed: 2025-02-17
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/770
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RubiconRouter Solidity contract (maxBuyAllAmount/maxSellAllAmount)
**Root cause:** After executing trades, maxBuyAllAmount transfers buy_gem back to the user instead of pay_gem (and similarly maxSellAllAmount), so the router pays out the wrong asset.
**Steps:**
1. Deploy a fake ERC20 only attacker can mint.
2. Create market approval for the fake token via router.offerWithETH and router.buyAllAmountForETH (maxBuyAllAmount doesn't approve new tokens).
3. market.offer(1, TUSDC, routerBalance, FAKE, 0, attacker, attacker) — offer 1 USDC for a large amount of fake token.
4. FAKE.transfer(router, routerBalance + fees) so router can buy the offer.
5. Call router.maxBuyAllAmount(TUSDC, FAKE, type(uint256).max); router pays out TUSDC (buy_gem) instead of FAKE (pay_gem).
6. Attacker receives router's USDC balance.
**How found:** Code reading of the final transfer in maxBuyAllAmount/maxSellAllAmount revealed buy_gem used where pay_gem was intended; the approval precondition was worked around via ETH trades to make the path reachable.
**Exploitation:** Attacker seeds the router with worthless self-minted fake tokens, then triggers maxBuyAllAmount against a self-created offer priced in a real token; the router's final transfer uses buy_gem (the real token) rather than pay_gem, sending the router's entire real-token balance to the attacker.
**Insight:** When auditing router/aggregator helpers, verify that the token refunded after a swap matches the token actually paid; also check whether missing approvals gate a bug path and can be satisfied via a separate entrypoint (e.g. ETH trade) to make it exploitable.