# Unverified 0x6077: unprotected uniswapV3SwapCallback drains funds

Unverified contract 0x6077 exposed uniswapV3SwapCallback without access control, letting attacker drain ~$62.3K in WETH and USDC.

- Payout: Real-world hack
- Severity: high
- Program: Unverified 0x6077
- Credited: DeFiHackLabs
- Disclosed: 2025-04-11
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/Unverified_6077_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250411-unverified-6077
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** Uniswap V3 swap callback on Base contract 0x607742a2adea4037020e11bb67cb98e289e3ec7d
**Root cause:** The contract's uniswapV3SwapCallback is externally callable with no caller authentication or pool verification, so anyone can invoke it with arbitrary deltas and data to trigger token transfers.
**Steps:**
1. Fork Base at block 28791089.
2. Deploy AttackContract and call `uniswapV3SwapCallback(-125859570852398, 22510000000000000000, hex"...ddddf3d84a1e94036138cab7ff35d003c1207a77...5ad023c7e400")` on 0x6077.
3. Contract transfers WETH to attacker; repeat with AttackContract2 using amount1Delta `27260000000` to drain USDC.
**Exploitation:** Attacker directly calls the unauthenticated uniswapV3SwapCallback on the vulnerable contract with crafted negative/positive deltas and a data blob encoding a recipient (0xddddf3d84a1e94036138cab7ff35d003c1207a77) and amount, causing the contract to send its WETH and USDC balances to the attacker.
**Insight:** On forked chains, scan for externally callable Uniswap V3 callback functions on contracts that are not registered pools; if the callback lacks a `msg.sender == pool` check, arbitrary deltas can be passed to force payouts.