# Malicious admin combing with low-level call can steal funds from user or form

Malicious/compromised admin whitelists a token address as a bridge, so _dispatchTokens low-level-calls transferFrom and drains users' approved balances.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: ladboy233 - Sparkware
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.13
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.13
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** LiquidityHandler._dispatchTokens low-level bridge call
**Root cause:** _dispatchTokens performs an arbitrary low-level call to an admin-whitelisted bridge address; if a token address is whitelisted, the call executes token functions like transferFrom against users' standing allowances.
**Steps:**
1. User grants infinite USDC allowance to the Superform router.
2. Compromised admin whitelists USDC token address as bridge for bridgeId 1000, so `superRegistry.getBridgeAddress(bridgeId)` returns USDC.
3. Attacker crafts `txData = abi.encodeWithSelector(IERC20.transferFrom.selector, victim, attacker, balance)`.
4. Trigger `_dispatchTokens`, which executes `payable(bridge_).call(txData_)` against the USDC contract, pulling victim funds to attacker.
**How found:** Code review of _dispatchTokens: noticed the bridge address is fully admin-controlled and invoked via arbitrary low-level call, so the 'bridge' need not be a bridge at all — a token contract satisfies the call.
**Exploitation:** Requires admin compromise or malicious admin to whitelist a token as a bridge; then a crafted txData invoking transferFrom on the token contract drains any user who granted the router allowance.
**Insight:** When a contract low-level-calls an admin-whitelisted address, check whether a token contract could be whitelisted instead: token selectors like transferFrom then execute against users' standing allowances to the calling contract.