# Spectra Finance: unvalidated command dispatch drains asdCRV via transferFrom

Spectra Finance contract lacked input validation on a command dispatcher, letting attacker pass arbitrary calldata to transferFrom and drain ~73K USD of asdCRV from a victim.

- Payout: Real-world hack
- Severity: high
- Program: Spectra_finance
- Credited: DeFiHackLabs
- Disclosed: 2024-07-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-07/Spectra_finance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240724-spectra-finance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** On-chain router/dispatcher contract (0x3d20...9F1a) with command-based call execution
**Root cause:** The contract's command dispatcher (selector 0x3593564c) accepted attacker-supplied target, token, recipient and calldata without validating them, so an arbitrary call could be made to the asdCRV token's transferFrom.
**Steps:**
1. Fork mainnet at block 20369956.
2. Build datas = abi.encode(asdCRV, 0xEeee..., 0, attacker, 1, abi.encodeWithSelector(0x23b872dd, victim, attacker, asdCRV.balanceOf(victim))) — i.e. transferFrom(victim, attacker, fullBalance).
3. Set command = hex"12" and data[0] = datas.
4. Call VulnContract with selector 0x3593564c (command, data, deadline).
5. Contract executes the embedded transferFrom, moving victim's asdCRV to attacker.
**How found:** Researcher (shoucccc) identified that the command-dispatch entrypoint passed user-controlled calldata straight through to token calls without validating target or arguments, enabling arbitrary transferFrom.
**Exploitation:** Attacker called the vulnerable dispatcher with a crafted command (0x12) whose payload encoded a transferFrom from the victim address to the attacker for the victim's full asdCRV balance. Because the contract did not validate the target/token/recipient/calldata, it executed the arbitrary transferFrom, siphoning ~73K USD of asdCRV.
**Insight:** When a contract exposes a generic command/execute dispatcher, check whether target, token, spender and calldata are validated; an unvalidated command byte plus arbitrary calldata often yields arbitrary transferFrom against any holder who granted allowance to the contract.