# UnverifiedContr 0x452E25: unprotected swap callback drains 27 ETH

Unverified contract's uniswapV3SwapCallback lacked access control, letting anyone call it with crafted data to drain ~27 ETH of WETH.

- Payout: Real-world hack
- Severity: high
- Analysis by: DeFiHackLabs
- Disclosed: 2024-07-03
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-07/UnverifiedContr_0x452E25_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240703-unverifiedcontr-0x452e25
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Uniswap V3 swap callback on an unverified mainnet contract
**Root cause:** The contract's uniswapV3SwapCallback was externally callable without verifying the caller was the Uniswap pool or that a swap was in progress, and it transferred funds based on attacker-supplied data.
**Steps:**
1. Fork mainnet at block 20223094.
2. Call `uniswapV3SwapCallback(27349000000000000000, 27349000000000000000, abi.encode(true, WETH))` on victim `0x452E253EeB3Bb16e40337D647c01b6c910Aa84B3`.
3. Callback decodes data and sends WETH to caller.
4. Attacker contract receives ~27.349 WETH profit.
**How found:** Likely source/bytecode review of an unverified contract revealing an externally exposed Uniswap callback lacking pool/caller validation.
**Exploitation:** Attacker directly invoked the victim's uniswapV3SwapCallback with positive deltas and crafted data encoding (true, WETH address), causing the contract to pay out WETH to the attacker without any real swap.
**Insight:** Uniswap V3 callbacks on contracts that aren't pools are a recurring drain vector: any contract implementing uniswapV3SwapCallback must verify msg.sender is the legitimate pool and that a swap is active, otherwise anyone can trigger its payout logic directly.