# Phoenix: unauthenticated delegateCallSwap drains WETH via arbitrary call

Phoenix's PhxProxy delegateCallSwap lacked access control, letting an attacker make arbitrary external calls to drain WETH and profit ~$100k.

- Payout: Real-world hack
- Severity: high
- Program: - Phoenix
- Analysis by: DeFiHackLabs
- Disclosed: 2023-03-07
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-03/Phoenix_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230307-phoenix
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control

**Target:** PhxProxy contract on Polygon
**Root cause:** delegateCallSwap() had no access control and accepted arbitrary calldata, allowing any caller to execute arbitrary external calls in the contract's context.
**Steps:**
1. Attacker flash-loans 8000 USDC from DODO.
2. Approves USDC to phxProxy and calls `buyLeverage(8000e6, 0, block.timestamp, new bytes(0))` to convert USDC into WETH held by phxProxy.
3. Calls `delegateCallSwap(abi.encodeWithSelector(0xa9678a18, address(Router), address(WETH), address(MYTOKEN), swapAmount))` to swap phxProxy's WETH for attacker's MYTOKEN.
4. Swaps the acquired MYTOKEN back to USDC via Uniswap Router, repays the flash loan, and keeps the profit.
**How found:** Likely identified the missing access control on delegateCallSwap and the ability to pass arbitrary calldata, then crafted a token and swap path to siphon WETH.
**Exploitation:** Attacker used a flash loan to buy leverage, then abused the unprotected delegateCallSwap to make phxProxy swap its WETH for the attacker's worthless token at an attacker-controlled rate, extracting value.
**Insight:** Look for public functions that perform delegatecall or arbitrary external calls without access control; they can be used to make the contract trade its own assets for attacker tokens.