# Zero-receiver fund burn

RouterV2 swap functions never populate route.receiver, so swapped tokens are sent to address(0) and permanently burned, causing total loss of user funds.

- Payout: Contest reward
- Severity: medium
- Program: Blackhole
- Credited: 0x15
- Disclosed: 2025-07-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-05-blackhole#m-09
- Library page: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RouterV2.sol swap functions (_swap, swapExactTokensForTokens, swapExactTokensForTokensSimple)
**Root cause:** The route struct's receiver field defaults to address(0) and is never set in swapExactTokensForTokensSimple or by direct callers of swapExactTokensForTokens; _swap uses routes[i].receiver as the swap recipient while ignoring the _to parameter.
**Steps:**
1. Call `swapExactTokensForTokensSimple(amountIn, amountOutMin, tokenFrom, tokenTo, stable, concentrated, to, deadline)` with any valid tokens.
2. Observe routes[0].receiver is left as address(0) since only from/to/stable/concentrated are set.
3. `_swap` passes `routes[i].receiver` (address(0)) as recipient to exactInputSingle or as the `to` arg of IBaseV1Pair.swap.
4. Swapped output tokens are transferred to address(0) and burned; user receives nothing.
**How found:** Code reading of RouterV2: noticed _swap ignores the _to parameter and relies solely on routes[i].receiver, then traced route construction in swapExactTokensForTokensSimple and direct-call paths to confirm receiver is never populated.
**Exploitation:** Any user calling the affected swap entrypoints loses 100% of swapped output to the zero address; no attacker capital or special precondition needed beyond normal usage.
**Insight:** When a struct carries both a top-level `to` parameter and a per-route `receiver`, check which one the internal swap actually consumes; unset struct fields default to address(0), so any path that builds routes without explicitly setting receiver silently burns funds.