# LimitOrderProtocol: unrestricted transferTokens drains victim allowance

Unrestricted transferTokens() in LimitOrderProtocol implementation let attacker spend victim's existing BRAINS allowance to steal 2.8M BRAINS.

- Payout: Real-world hack
- Severity: high
- Program: LimitOrderProtocol
- Credited: DeFiHackLabs
- Disclosed: 2025-02-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/LimitOrderProtocol_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250211-limitorderprotocol
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** LimitOrderProtocol proxy implementation on Base
**Root cause:** The implementation contract exposed a public transferTokens() helper with no access control or allowance check, allowing anyone to move tokens from any address that had approved the proxy.
**Steps:**
1. Identify victim with BRAINS allowance to LimitOrderProtocol proxy `0xb5486f71C902fe0844Bb07221Fa8f47834d90B1b`.
2. Call `transferTokens(BRAINS_TOKEN, VICTIM, ATTACKER, victimBalance)` on the proxy.
3. Proxy delegates to implementation `0xCe8D7Cd4DdB3Fd50bAae0Cc59DBfd786a7f0e44e` which executes transferFrom using the victim's allowance.
**Exploitation:** Attacker directly invoked the unrestricted transferTokens() on the proxy, specifying the victim as 'from' and attacker as 'to', draining the victim's full BRAINS balance (2.8M) using the victim's pre-existing allowance to the proxy.
**Insight:** When a proxy delegates to an implementation, any public function on the implementation is callable via the proxy; look for helper functions that perform token transfers without checking msg.sender or allowance.