# MixedSwapRouter: arbitrary callback drains victim WINR via fake pool

MixedSwapRouter's algebraSwapCallback trusted attacker-supplied payer and pool, letting a fake pool drain a victim's WINR tokens via arbitrary callback.

- Payout: Real-world hack
- Severity: high
- Program: MixedSwapRouter
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-31
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/MixedSwapRouter_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240531-mixedswaprouter
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity DEX router swap callback on Arbitrum
**Root cause:** algebraSwapCallback accepts caller-controlled SwapCallbackData with arbitrary payer and pool addresses, and pulls tokens from the named payer without verifying the pool or that a real swap occurred.
**Steps:**
1. Deploy fake pool contract implementing swap/token0/token1/fee returning WINR for both tokens.
2. Call `swapTokensForTokens` with `pool=[fakePool]` and path WINR->WINR, amountIn=10.
3. Router invokes fakePool.swap, which calls `Swaprouter.algebraSwapCallback(-20057735863910611438, 293182421809175367609122, abi.encode(SwapCallbackData{path:WINR-WINR, payer:victim, pool:fakePool}))`.
4. Router transfers WINR from victim to the fake pool based on the callback amounts.
5. Fake pool forwards drained WINR to attacker.
**Exploitation:** Attacker deploys a malicious pool via CREATE2, routes a swap through the router pointing at it, and the fake pool's swap() invokes algebraSwapCallback with payer set to the victim address, causing the router to pull the victim's WINR balance to the attacker-controlled pool.
**Insight:** When a router's swap callback trusts a caller-supplied `payer` and `pool`, you can register a fake pool that calls the callback directly with a victim as payer — no real liquidity or swap needed; look for callbacks that pull funds from an address named in calldata.