# Swap functionality to sell rewards is too permissive and could cause accidental or intentional loss of value

VotiumStrategy.applyRewards grants arbitrary token approvals and executes arbitrary calls, letting the rewarder misuse strategy-held tokens instead of only swapping via 0x.

- Payout: Contest reward
- Severity: medium
- Program: Asymmetry Finance
- Credited: adriro
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/54
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VotiumStrategyCore.applyRewards reward-swap function
**Root cause:** applyRewards approves type(uint256).max to any caller-supplied spender and executes arbitrary swapCallData on any swapTarget, with no enforcement that the 0x protocol or ETH output is used.
**Steps:**
1. Rewarder calls `applyRewards(SwapData[])` with a crafted entry where `sellToken` is a strategy-held reward token and `spender` is an attacker-controlled address.
2. Contract approves `type(uint256).max` allowance to that spender.
3. Attacker spender calls `transferFrom` to drain the approved tokens.
4. Alternatively supply `swapTarget`/`swapCallData` to invoke arbitrary calls from the strategy context.
**How found:** Code review of applyRewards against documented intent (swap rewards via 0x for ETH); noticed approvals and calls are fully caller-controlled with no 0x/output-token validation.
**Exploitation:** A malicious or compromised rewarder role supplies arbitrary spender and swapTarget/swapCallData, obtaining unlimited token approvals and arbitrary external calls executed by the VotingStrategy, enabling theft or value loss of strategy-held reward tokens.
**Insight:** When a function's docs promise a specific DEX/protocol, check whether the code actually constrains target, spender, and calldata to that protocol; unconstrained approval+call primitives in privileged functions are a recurring finding.