# UniBotRouter: arbitrary call drains UniBot token approvals

UniBotRouter's arbitrary external call let an attacker invoke transferFrom on UniBot token for 17 victims, stealing ~$83,944.

- Payout: Real-world hack
- Severity: high
- Program: UniBotRouter
- Analysis by: DeFiHackLabs
- Disclosed: 2023-10-31
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-10/UniBot_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231031-unibot
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** UniBotRouter contract on Ethereum mainnet
**Root cause:** The router exposed a function (selector b2bd16ab) that performs an arbitrary external call to a user-supplied target with user-supplied calldata, without restricting the target or function.
**Steps:**
1. Identify UniBotRouter at 0x126c9FbaB3A2FCA24eDfd17322E71a5e36E91865 and UniBot token at 0xf819d9Cb1c2A819Fd991781A822dE3ca8607c3C9.
2. Enumerate 17 victim addresses with UniBot allowances to the router.
3. For each victim, compute min(allowance, balance).
4. Craft calldata: `abi.encodeWithSelector(0xb2bd16ab, [0xEeee..., UniBot, UniBot, UniBot], 0, true, 100000, abi.encodeWithSignature("transferFrom(address,address,uint256)", victim, attacker, amount), new address[](1))`.
5. Call the router with this calldata; the router executes transferFrom, moving victim UniBot tokens to the attacker.
6. Repeat for all victims; total ~$83,944 stolen.
**How found:** Likely discovered by reviewing the router's function selector b2bd16ab and noticing it forwards arbitrary calldata to an arbitrary address, enabling transferFrom on tokens where users had approved the router.
**Exploitation:** Attacker called the vulnerable router function with calldata that made the router call UniBot.transferFrom(victim, attacker, amount) for each victim, using the victims' existing allowances to the router. No capital or flash loan needed; multiple transactions were sent.
**Insight:** When a contract holds token allowances, check for any function that performs arbitrary external calls (e.g., via low-level call with user-controlled target and data); such a function can be abused to invoke transferFrom on the allowance-holding token.