# Malicious actors can exploit user-approved allowances on VaultRouter to drain their ERC20 tokens

VaultRouter's PUSH_TOKEN_FROM/PULL_TOKEN_FROM commands let anyone spend a user's approved ERC20 allowance, draining tokens to an arbitrary address.

- Payout: Audit contest
- Severity: high
- Program: BakerFi
- Found by: 0xpiken
- Disclosed: 2025-02-26
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#h-06
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VaultRouter.execute() command dispatcher (UseTokenActions hooks)
**Root cause:** pullTokenFrom/pushTokenFrom only check token.allowance(from, address(this)) and never verify msg.sender == from, so any caller can move tokens the user approved to VaultRouter.
**Steps:**
1. User approves VaultRouter to spend their ERC20 (required for PULL_TOKEN deposits).
2. Attacker builds commands array with PUSH_TOKEN_FROM encoding `pushTokenFrom(weth, victim, attacker, amount)`.
3. Attacker calls `vaultRouter.execute(commands)` from their own account.
4. safeTransferFrom moves victim's tokens directly to attacker; allowance check passes because VaultRouter is approved.
**How found:** Code review of the command hooks: noticed pullTokenFrom/pushTokenFrom trust the `from` parameter and only gate on allowance, with no msg.sender binding, making the router a confused deputy for any approved user.
**Exploitation:** Attacker needs only the victim's prior approval to VaultRouter; calls execute() with PUSH_TOKEN_FROM (direct transfer to attacker) or PULL_TOKEN_FROM + PUSH_TOKEN (route through router then out), extracting the full approved balance in one tx.
**Insight:** In router/multicall designs, any hook taking a `from`/`onBehalfOf` parameter must bind it to msg.sender or an explicit signature; allowance to the router alone is not authorization for third parties to move funds.