# Anyone can DOS handleReallocation over and over

Li.Fi Executor holds SWAP_CALLER_ROLE but its swapAndExecute is permissionless, letting anyone make it call renounceRole on NudgeCampaignFactory and permanently block handleReallocation.

- Payout: Contest reward
- Severity: medium
- Program: Nudge.xyz
- Credited: hakunamatata
- Disclosed: 2025-04-29
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-03-nudgexyz#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-03-nudgexyz%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:access-control vuln:dos

**Target:** NudgeCampaignFactory / Li.Fi Executor swapAndExecute
**Root cause:** The Executor contract is granted SWAP_CALLER_ROLE but exposes swapAndExecute without access control, allowing arbitrary external calls including renounceRole on the factory.
**Steps:**
1. Deploy attacker-controlled ERC20 token and approve Executor/ERC20Proxy
2. Build LibSwap.SwapData with callTo=factory, callData=`renounceRole(SWAP_CALLER_ROLE, address(executor))`
3. Call `executor.swapAndExecute(transactionId, swapDataArray, token, receiver, amount)`
4. Executor executes renounceRole, dropping its own SWAP_CALLER_ROLE
5. All subsequent handleReallocation calls revert; repeat after admin re-grants role
**How found:** Noticed Executor holds SWAP_CALLER_ROLE while its swapAndExecute is intentionally permissionless, then realized arbitrary callTo targets let the Executor be weaponized against its own role via renounceRole.
**Exploitation:** Attacker uses the permissionless swapAndExecute to instruct the Executor to invoke renounceRole on NudgeCampaignFactory, stripping the Executor's SWAP_CALLER_ROLE and bricking handleReallocation until admin re-grants, which attacker can re-trigger indefinitely.
**Insight:** When a privileged contract is granted a role but exposes a permissionless arbitrary-call primitive, check whether the contract can be made to call role-management functions (renounceRole, revokeRole) on itself or its granters.