# Users can use the protocol freely without paying any fees by calling the DecentEthRouter::bridgeWithPayload() function directly.

DecentEthRouter::bridgeWithPayload lacks access control, letting users bypass UTB fee collection by calling it directly after doing their own swap.

- Payout: Contest reward
- Severity: medium
- Program: Decent
- Credited: NPCsCorp
- Disclosed: 2024-03-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-decent-findings/issues/647
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:fee-bypass

**Target:** DecentEthRouter bridgeWithPayload on-chain function
**Root cause:** DecentEthRouter::bridgeWithPayload has no access control restricting callers to DecentBridgeAdapter, so the fee-collecting UTB entrypoint can be skipped entirely.
**Steps:**
1. Perform the pre-bridge swap (e.g. USDC->WETH) directly on Uniswap.
2. Encode the LzCallParams and bridge payload that DecentBridgeAdapter would have produced.
3. Call `DecentEthRouter::bridgeWithPayload(...)` directly from an EOA, skipping `UTB::bridgeAndExecute()` and `UTBFeeCollector::collectFees()`.
**How found:** Traced the bridgeAndExecute -> callBridge -> DecentBridgeAdapter::bridge -> DecentEthRouter::bridgeWithPayload call chain and noticed the router function has no modifiers, so fee collection in UTB is not enforced.
**Exploitation:** User replicates the swap and calldata preparation off-protocol, then invokes the unprotected router function directly, completing the bridge without ever paying Decent's fee.
**Insight:** When a fee or accounting step lives in a wrapper contract, check whether the inner router/adapter function it calls is externally reachable without access control; if so the wrapper's invariants are optional.