# LQDX LiquidXv2Zap: unauthorized transferFrom drains victim approvals

LQDX LiquidXv2Zap deposit lacks account==msg.sender check, letting anyone spend a victim's approved WETH to buy LQDX and add liquidity.

- Payout: Real-world hack
- Severity: high
- Program: LQDX
- Analysis by: DeFiHackLabs
- Disclosed: 2024-01-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-01/LQDX_alert_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240110-lqdx-alert
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LiquidXv2Zap contract deposit function
**Root cause:** The deposit function accepts an arbitrary `account` parameter and pulls tokens from that account without verifying it equals msg.sender, so any caller can spend another user's approval granted to the zap contract.
**Steps:**
1. Victim approves WETH to the LiquidXv2Zap contract (0x364f17A23AE4350319b7491224d10dF5796190bC).
2. Attacker calls `zap.deposit(victim, WETH, WETH, emptyPath, WETH, LQDX, [victimAllowance,0,0], 0)`.
3. The contract executes transferFrom(victim, zap, allowance) using the victim's approval.
4. The stolen WETH is swapped for LQDX and added as liquidity to the WETH-LQDX pair, benefiting the attacker.
**How found:** Code review of the deposit function revealed the missing msg.sender check on the account parameter, enabling arbitrary transferFrom from any user who approved the zap.
**Exploitation:** Attacker needs no capital: they simply call deposit with the victim's address and the victim's approved allowance as the amount. The zap pulls the victim's WETH, swaps it to LQDX, and adds liquidity to the WETH-LQDX pair, with the attacker controlling the resulting LP position.
**Insight:** When a contract exposes a function that takes an `account` or `from` parameter and later calls transferFrom, always verify that the parameter is bound to msg.sender; otherwise any prior approval to that contract becomes spendable by anyone.