# Multiple ways for reentrancy in InfinityPoolsPeriphery through both swapForwarders could lead to loss of funds

Attacker-controlled swapForwarder callback reenters InfinityPoolsPeriphery.depositERC20 during COLLATERAL_SWAP, double-counting deposits into collateral for fund loss.

- Payout: Contest reward
- Severity: high
- Program: InfinityPools
- Credited: ktl
- Disclosed: 2025-01-13
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinitypools_october2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:reentrancy

**Target:** InfinityPoolsPeriphery payment callback / swap forwarders
**Root cause:** infinityPoolPaymentCallback invokes an attacker-supplied swapForwarder (GeneralSwapForwarder with controlled to/data, or UniV2SwapForwarder with attacker-controlled path through a malicious token) before finalizing accounting, allowing reentrancy into depositERC20 which credits the periphery balance that is then double-counted into the user's collateral.
**Steps:**
1. Deploy GeneralSwapForwarder and register via `periphery.addOrRemoveSwapForwarder(swap_forwarder, true)`
2. Build SwapInfo with `swapForwarder=address(swap_forwarder)`, `to=address(this)`, `data=abi.encodeWithSelector(bytes4(keccak256("malicious_callback()")))`
3. Call `periphery.newLoan(token0, token1, 15, address(this), swap_params, new_loan_params)` triggering COLLATERAL_SWAP
4. In malicious_callback, pull allowance via `token1.transferFrom(msg.sender, address(this), allowance1)`, send back `allowance1 + allowance1/500`, then call `periphery.depositERC20(IERC20(token0), address(this), allowance1 + allowance1/500, false, 0, 0, bytes(""))`
5. Observe collaterals/deposits inflated (6.22e17) versus actual tokens paid
**How found:** Code review of infinityPoolPaymentCallback's COLLATERAL_SWAP branch noting both swapForwarders accept attacker-controlled calldata/path, giving external control flow before accounting is finalized.
**Exploitation:** Attacker registers a malicious swap forwarder, triggers newLoan with COLLATERAL_SWAP, and inside the callback deposits tokens back into the periphery so the same balance is counted both as swap payment and as a deposit, inflating credited collateral beyond funds actually supplied.
**Insight:** When a periphery contract lets users pick a swap adapter and passes attacker-controlled `to`/`data` (or a permissionless Uniswap path), treat the callback as an untrusted reentrancy point and check whether any deposit/credit function can be reentered before the outer accounting writes.