# ODOS LimitOrderRouter: forged ERC-6492 signature drains USDC

ODOS LimitOrderRouter's isValidSigImpl accepted a forged ERC-6492 signature, letting an attacker execute arbitrary calls and drain ~50k USDC.

- Payout: Real-world hack
- Severity: high
- Program: ODOS
- Credited: DeFiHackLabs
- Disclosed: 2025-01-23
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-01/ODOS_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250123-odos
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:signature-replay

**Target:** OdosLimitOrderRouter contract on Base
**Root cause:** isValidSigImpl failed to properly validate ERC-6492 signatures, allowing an attacker to supply a crafted signature that passed verification and executed arbitrary calldata.
**Steps:**
1. Identify OdosLimitOrderRouter at `0xB6333E994Fd02a9255E794C177EfBDEB1FE779C7` on Base.
2. Construct calldata to call USDC `transfer(address(this), victimUSDCBalance)`.
3. Build signature: `abi.encodePacked(abi.encode(address(USDCInstance), customCalldata, bytes(hex"01")), ERC6492_DETECTION_SUFFIX)` where suffix is `0x6492...6492`.
4. Call `isValidSigImpl(address(0x04), bytes32(0), signature, true)` on the router.
5. Router executes the embedded call, transferring USDC from router to attacker.
**How found:** Likely discovered by reviewing the ERC-6492 signature validation logic in isValidSigImpl and noticing that arbitrary calldata could be embedded and executed when allowSideEffects is true.
**Exploitation:** Attacker crafted a malicious ERC-6492 signature containing a USDC transfer call and passed it to isValidSigImpl with allowSideEffects=true. The router executed the call, draining its USDC balance (~50k) to the attacker.
**Insight:** When a contract supports ERC-6492 signature validation with side effects, check if attacker-controlled calldata can be executed during validation; the magic suffix 0x6492...6492 is a key indicator to test.