# 0x Settler: arbitrary external call drains USDT allowance

0x MainnetSettler's BASIC action let attacker supply arbitrary target and calldata, invoking USDT.transferFrom to drain a victim's pre-existing allowance of 3,008 USDT.

- Payout: Real-world hack
- Severity: high
- Program: ZeroExSettler
- Credited: DeFiHackLabs
- Disclosed: 2025-03-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-03/ZeroExSettler_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250311-zeroexsettler
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:recon vuln:access-control vuln:business-logic

**Target:** MainnetSettler execute() BASIC action
**Root cause:** The BASIC action accepts a caller-chosen target address and arbitrary calldata and executes it from the Settler contract, so the Settler's own token allowances become spendable by anyone.
**Steps:**
1. Identify victim 0x4D38...7b4b holding 3,008 USDT with a large pre-existing allowance to MainnetSettler 0x0d0E...428F.
2. Build calldata `transferFrom(victim, attacker, 3008000000)` on USDT 0xdAC1...1ec7.
3. Encode a BASIC action (selector `0x38c9c147`) with target USDT and that calldata.
4. Call `MainnetSettler.execute(slippage, actions, zidAndAffiliate)` with one action.
5. Settler executes transferFrom as spender, moving victim USDT to attacker.
**How found:** Attacker likely scanned token allowances granted to the Settler contract and found a victim with a large outstanding USDT approval, then abused the arbitrary-call BASIC action to spend it.
**Exploitation:** Single execute() call with one BASIC action targeting USDT; the Settler's existing allowance from the victim let it pull 3,008 USDT to the attacker with no capital or flash loan.
**Insight:** Settler/router contracts that execute caller-supplied target+calldata turn every user's outstanding token allowance into a honeypot; enumerate allowances to such contracts and check whether any action path lets you choose the target.