# In ZetaTokenConsumerTrident.strategy.sol, swapping zeta for other tokens will always revert due to incorrect exactInputSingle router method  being used

ZetaTokenConsumerTrident.getZetaFromToken calls TridentRouter.exactInputSingle, which moves Bento shares instead of raw ERC-20, so every ZETA swap reverts.

- Payout: Contest reward
- Severity: high
- Program: ZetaChain
- Credited: oakcobalt ([1](https://github.com/code-423n4/2023-11-zetachain-findings/issues/387)
- Disclosed: 2024-09-06
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/387
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AH-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ZetaTokenConsumerTrident.strategy.sol getZetaFromToken / Sushi TridentRouter
**Root cause:** getZetaFromToken approves and transfers raw ERC-20 to itself, then calls TridentRouter.exactInputSingle, which calls bento.transfer on the caller's Bento shares; the strategy never deposits into Bento nor approves the router for Bento shares, so the transfer reverts.
**Steps:**
1. Call `getZetaFromToken(destinationAddress, minAmountOut, inputToken, inputTokenAmount)`.
2. Contract does `IERC20(inputToken).safeTransferFrom(msg.sender, address(this), inputTokenAmount)` and `safeApprove(tridentRouter, inputTokenAmount)`.
3. Builds `ExactInputSingleParams` and calls `tridentRouter.exactInputSingle(params)`.
4. TridentRouter executes `bento.transfer(params.tokenIn, msg.sender, params.pool, params.amountIn)`.
5. BentoBox `transfer` has `allowed(from)` modifier checking Bento share allowance of the strategy for the router; strategy has no Bento shares and no approval, so call reverts.
**How found:** Code reading of getZetaFromToken against Sushi TridentRouter and BentoBox source: noticed the strategy approves raw ERC-20 but exactInputSingle operates on Bento shares via bento.transfer, and the strategy has no Bento deposit/approval path.
**Exploitation:** Not weaponizable; the flaw is a functional DoS: any flow invoking getZetaFromToken (swapping any token to ZETA via Trident) reverts, blocking that swap path.
**Insight:** When integrating with Sushi Trident, distinguish raw-token router entrypoints (exactInputSingleWithNativeToken) from Bento-share entrypoints (exactInputSingle); check whether the integrating contract ever deposits into Bento or approves Bento shares before calling share-based functions.