# Keeper can steal funds from the dstswapper

Malicious keeper sets high slippage on a small dst-swap deposit to sandwich the DstSwapper's full interim-token balance swap, stealing user funds.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: rvierdiiev
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.5
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.5
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:chained vuln:access-control vuln:business-logic

**Target:** DstSwapper.processTx / _processTx swap flow
**Root cause:** _processTx only checks that CSR balance increased by the user-requested amount and that receiver is CSR; it does not bound the swap's slippage/value, so a keeper-controlled txData with >90 slippage can be sandwiched against the entire interim-token balance held by DstSwapper.
**Steps:**
1. Keeper creates a small cross-chain deposit with dst swap, setting interim token to the victim token they want to steal.
2. Keeper supplies txData with high slippage (>90) so the swap tolerates large price movement.
3. Keeper sandwiches the subsequent swap that consumes the entire interim-token balance in DstSwapper.
4. Swap still delivers the small requested amount to CSR, so balance and slippage checks pass and tx does not revert; keeper pockets the difference.
**How found:** Code review of _processTx validation: noticed only receiver==CSR and CSR balance-increase checks exist, with no oracle/value bound on slippage, and reasoned that a keeper controlling txData could exploit high slippage against the pooled interim-token balance.
**Exploitation:** Keeper role (currently protocol, planned to be permissionless) crafts txData for DstSwapper.processTx; high slippage plus sandwiching the full-balance swap lets them profit while the CSR balance check still passes, draining user funds from DstSwapper.
**Insight:** When a privileged role supplies swap parameters (txData) validated only by a post-hoc balance-increase check, check whether slippage tolerance is attacker-chosen and whether the swap consumes a pooled balance larger than the triggering deposit — that gap enables sandwich theft.