# MaestroRouter2: arbitrary external call drains user token approvals

MaestroRouter2 exposed an arbitrary external call function, letting an attacker invoke transferFrom on victim tokens to drain ~280 ETH via Uniswap.

- Payout: Real-world hack
- Severity: critical
- Program: MaestroRouter2
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-24
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/MaestroRouter2_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231024-maestrorouter2
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MaestroRouter2 smart contract (Ethereum)
**Root cause:** The router contract contained a public function (selector 0x9239127f) that performed an arbitrary external call with attacker-supplied target, calldata, and flags, without restricting the target or validating the call.
**Steps:**
1. Identify MaestroRouter2 at 0x80a64c6D7f12C47B7c66c5B4E20E72bc1FCd5d9e and its logic at 0x8EAE9827b45bcC6570c4e82b9E4FE76692b2ff7a.
2. For each victim with a token allowance to the router, call the router with selector `0x9239127f` and arguments `(Mog token, abi.encodeWithSignature("transferFrom(address,address,uint256)", victim, attacker, amount), 0, false)`.
3. The router executes the external call, pulling the victim's Mog tokens to the attacker.
4. Swap the drained Mog tokens for WETH on Uniswap V2 router (0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D).
**How found:** Likely discovered by reviewing the router's public functions and noticing an unrestricted external call primitive that could be abused with existing token approvals.
**Exploitation:** Attacker sent multiple transactions to the vulnerable router, each time invoking the arbitrary-call function with a transferFrom payload targeting a different victim's token allowance. The router executed the call, transferring victim tokens to the attacker, who then swapped them for ETH on Uniswap. Total ~280 ETH stolen across 12 transactions.
**Insight:** When auditing routers or aggregators, look for public functions that take an arbitrary target and calldata and perform a low-level call; such functions can be used to invoke transferFrom on any token where the router has allowance, draining users who approved it.