# MEVbot 0xdd7c: unvalidated swap callback drains tokens

MEV bot 0xdd7c lacked validation in its swap callback, letting an attacker spoof a Uniswap V3 callback and drain ~18k USD in WETH, USDT, USDC.

- Payout: Real-world hack
- Severity: high
- Program: MEVbot_0xdd7c
- Credited: DeFiHackLabs
- Disclosed: 2024-07-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-07/MEVbot_0xdd7c_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240723-mevbot-0xdd7c
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:access-control vuln:business-logic

**Target:** MEV bot smart contract on Ethereum
**Root cause:** The vulnerable contract's swap callback (selector 0xfa461e33) did not validate the caller or the data, allowing an attacker to invoke it directly with crafted parameters and transfer victim tokens.
**Steps:**
1. Deploy attack contract via CREATE2 with salt derived from token address.
2. Call VulnContract with `abi.encodeWithSelector(0xfa461e33, -1, amount, data)` where data encodes victim, factory, codehash, and token pair.
3. The vulnerable contract executes callback logic, transferring its token balance to the attacker-controlled contract.
4. Attacker contract forwards drained WETH, USDT, USDC to owner.
5. Repeat for each token (WETH, USDT, USDC) using the victim's balance.
**How found:** Likely identified that the MEV bot's swap callback lacked caller validation and could be invoked externally with arbitrary data to trigger token transfers.
**Exploitation:** Attacker directly called the vulnerable contract's swap callback function with a negative amountIn and crafted data, bypassing validation to make the contract transfer its token holdings to the attacker's contract. No flash loan needed; the attacker simply invoked the callback with spoofed parameters.
**Insight:** MEV bots and other contracts that implement Uniswap-style callbacks must verify msg.sender is a legitimate pool and validate callback data; otherwise anyone can spoof the callback to drain funds.