# DePayRouter: fake token plugin drains USDC via route

DePayRouter's route function allowed a fake token contract to be used as a plugin, enabling an attacker to drain ~827 USDC via a flash-loan-funded Uniswap V2 swap.

- Payout: Real-world hack
- Severity: medium
- Program: DePayRouter
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-05
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/DePayRouter_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231005-depayrouter
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium tech:evm tech:solidity vuln:business-logic vuln:flash-loan

**Target:** DePayRouter smart contract on Ethereum
**Root cause:** The route function accepts arbitrary plugin addresses and data, allowing an attacker to pass a malicious contract as a plugin that manipulates token balances and liquidity.
**Steps:**
1. Attacker contract calls `UNIV2.swap(amount, 0, address(this), conAddress(address(USDC), address(DepayRouter)))` to initiate a flash loan of USDC.
2. In `uniswapV2Call`, attacker calls `UniRouter.addLiquidity(sender, address(USDC), 1e30, 1, amountAMin, 1, address(this), type(uint256).max)` to create a fake liquidity pool with a fake token contract.
3. Attacker calls `DepayRouter.route(path, amounts, addresses, plugins, data)` with `plugins` set to the fake token contract address twice, causing the router to interact with the fake token.
4. Attacker removes liquidity via `UniRouter.removeLiquidity` and repays the flash loan with `USDC.transfer(address(UNIV2), amount * 1001 / 997)`.
**Exploitation:** Attacker used a flash loan from Uniswap V2 to obtain USDC, created a fake token contract with manipulated balanceOf/transfer functions, added liquidity to a fake Uniswap pair, then called DePayRouter.route with the fake token as a plugin. The router's logic executed the fake token's transfer functions, allowing the attacker to drain USDC from the router. Finally, the attacker removed liquidity and repaid the flash loan, netting ~827 USDC.
**Insight:** When a router accepts arbitrary plugin addresses, check if a malicious contract can be passed as a plugin to manipulate token balances or bypass intended logic; fake tokens with custom transfer/balanceOf can be used to trick routers into transferring real funds.