# DoughFina: input validation flaw in flashloanReq drains $1.8M

DoughFina's ConnectorDeleverageParaswap lacked input validation, letting an attacker manipulate debt/collateral and drain ~$1.8M via a crafted flashloanReq call.

- Payout: Real-world hack
- Severity: critical
- Program: DoughFina
- Credited: DeFiHackLabs
- Disclosed: 2024-07-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-07/DoughFina_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240712-doughfina
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ConnectorDeleverageParaswap contract
**Root cause:** The flashloanReq function failed to validate user-supplied parameters (debt tokens, amounts, swap data), allowing an attacker to specify arbitrary debt and collateral manipulations.
**Steps:**
1. Attacker flash-loans 80M USDC.
2. Repays 938,566,826,811 USDC to Aave on behalf of victim 0x534a...d085.
3. Transfers 6M USDC to vulnerable contract 0x9f54...fBE6.
4. Calls `flashloanReq(false, [USDC], [5_000_000], [0], [], [], swapData)` with crafted swapData.
5. swapData[0] encodes a call to `0x75b4b22d` (deleverage) with parameters to swap 5M USDC for 596.744 WETH.
6. swapData[1] encodes a `transferFrom` (0x23b872dd) moving 596.744 WETH from victim to attacker.
7. Attacker receives WETH and profits.
**Exploitation:** Attacker used a flash loan to fund the attack, repaid a victim's Aave debt to gain control, then called flashloanReq with malicious swapData that executed a deleverage and a transferFrom, siphoning 596.744 WETH (~$1.8M) from the victim.
**Insight:** When a contract accepts arbitrary swapData and executes low-level calls, check if attacker-controlled calldata can invoke transferFrom or other sensitive functions on behalf of other users.