# LaunchZone: arbitrary call in swapX drains deployer LZ allowance

Unverified swapX implementation allowed arbitrary callers to spend LaunchZone deployer's LZ allowance, draining tokens then swapped for ~$320k BUSD.

- Payout: Real-world hack
- Severity: high
- Program: - LaunchZone
- Analysis by: DeFiHackLabs
- Disclosed: 2023-02-27
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-02/LaunchZone_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230227-launchzone
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control

**Target:** swapX implementation contract (unverified) on BSC
**Root cause:** The unverified swapX implementation contract exposed a public function (selector 0x4f1f05bc) that executed arbitrary swap logic using the caller-supplied victim address, allowing anyone to spend the LZ allowance the BscexDeployer had granted to swapXImp.
**Steps:**
1. Fork BSC at block 26024420-1.
2. Call swapXImp (0x6D8981847Eb3cc2234179d0F0e72F6b6b2421a01) with payload `0x4f1f05bc...` encoding swapPath, transferAmount, value, array, and victim BscexDeployer (0xdad254728A37D1E80C21AFae688C64d0383cc307).
3. The call transfers LZ from BscexDeployer using the existing allowance to swapXImp.
4. Obtain 50 BUSD, approve BISWAPRouter, swap BUSD for LZ via BISWAPRouter to manipulate price.
5. Approve PancakeRouter for the acquired LZ and swap LZ back to BUSD, extracting ~88,899 BUSD.
**How found:** Researcher likely reviewed the unverified swapX implementation and noticed a public function accepting a victim address and swap parameters, then checked the deployer's LZ allowance to swapXImp.
**Exploitation:** Attacker called the vulnerable swapX implementation with a crafted payload that spent the BscexDeployer's LZ allowance, then used a small BUSD seed to buy LZ on BISWAP and sold the drained LZ on PancakeSwap for BUSD, netting ~$320k.
**Insight:** Unverified contracts with public functions that accept arbitrary victim addresses and perform token transfers using existing allowances are prime targets; check allowances from large holders to such contracts.