# FiberRouter: arbitrary calldata in swapAndCrossOneInch drains USDC

FiberRouter's swapAndCrossOneInch lacked calldata validation, letting attacker pass arbitrary transferFrom to drain victim's USDC via router.

- Payout: Real-world hack
- Severity: high
- Program: FiberRouter
- Analysis by: DeFiHackLabs
- Disclosed: 2023-11-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-11/FiberRouter_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20231128-fiberrouter
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** FiberRouter swapAndCrossOneInch function on BSC
**Root cause:** swapAndCrossOneInch passed user-supplied _calldata to an external call without validating the target or function selector, allowing arbitrary token transfers from any approved user.
**Steps:**
1. Attacker calls `pancakeRouter.swapExactETHForTokens` with tiny BNB to send USDC to FiberRouter, establishing approval.
2. Attacker crafts `_calldata` as `transferFrom(victim, attacker, victim_balance)`.
3. Attacker calls `fiberrouter.swapAndCrossOneInch` with `_calldata` and fromToken=USDC, foundryToken=USDC.
4. FiberRouter executes the arbitrary transferFrom, moving victim's USDC to attacker.
**How found:** Likely source review of swapAndCrossOneInch revealed unvalidated _calldata passed to an external call, enabling arbitrary token transfers from users who approved the router.
**Exploitation:** Attacker used a minimal BNB swap to get USDC into FiberRouter, then invoked swapAndCrossOneInch with malicious calldata that called USDC.transferFrom to drain the victim's balance. Profit ~59 USDC.
**Insight:** In DeFi routers, any user-supplied calldata forwarded to token contracts can be abused for transferFrom if the router holds approvals; check for missing validation of target and selector.