# GYMNET: insufficient validation in router drains victims

GYMNET router lacked validation allowing attacker to swap victim GYMNET for fake USDT, draining 18 victims via flash loan.

- Payout: Real-world hack
- Severity: high
- Program: GYMNET
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-31
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/GYMNET_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230731-gymnet
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm vuln:access-control vuln:business-logic

**Target:** GYMNET router contract on BSC
**Root cause:** The GYM router's swapExactTokensForTokensSupportingFeeOnTransferTokens function did not validate that the caller owned the tokens being swapped, allowing anyone to swap tokens from any address.
**Steps:**
1. Deploy fakeUSDT contract and acquire 9,990,000 fakeUSDT.
2. Take flash loan of 1,010,000 GYMNET from PancakePair via `swap(1_010_000 * 1e18, 0, address(this), new bytes(1))`.
3. Add liquidity to PancakeRouter for GYMNET-fakeUSDT using all GYMNET and fakeUSDT.
4. For each of 18 victim addresses, call `GymRouter.swapExactTokensForTokensSupportingFeeOnTransferTokens(GYMNET.balanceOf(victim), amountOutMin, path, victim)` where path is [GYMNET, fakeUSDT], swapping victim's GYMNET for fakeUSDT sent to victim.
5. Remove liquidity from PancakeRouter to retrieve GYMNET and fakeUSDT.
6. Repay flash loan by transferring 1,043,936 GYMNET to PancakePair.
**Exploitation:** Attacker flash-loaned GYMNET, added liquidity with fakeUSDT, then used the vulnerable GymRouter to swap GYMNET from 18 victims into fakeUSDT (which victims received). Attacker then removed liquidity, cashing out the GYMNET obtained from victims, and repaid the flash loan, keeping profit.
**Insight:** When a router or swap function accepts a token amount and recipient but does not verify that the caller is authorized to spend those tokens, anyone can drain any holder's balance by specifying the victim's address as the source.