# TSAggregatorGeneric: arbitrary call in swapIn drains USDT allowance

TSAggregatorGeneric.swapIn trusted caller-supplied swapRouter/data, letting attacker spend victim's USDT allowance via transferFrom and steal 1,300 USDT.

- Payout: Real-world hack
- Severity: high
- Program: TSAggregatorGeneric
- Credited: DeFiHackLabs
- Disclosed: 2025-06-14
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/TSAggregatorGeneric_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250614-tsaggregatorgeneric
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:access-control vuln:business-logic

**Target:** DeFi aggregator swapIn function on BSC
**Root cause:** swapIn accepted arbitrary swapRouter and data parameters and executed a call to that target, without validating that the call was a legitimate swap. Since the aggregator held victim USDT allowance, the attacker could make it call USDT.transferFrom(victim, attacker, amount).
**Steps:**
1. Deploy attack helper contract.
2. Call `TSAggregatorGeneric.swapIn(address(this), address(this), "", WBNB, 0, USDT, abi.encodeWithSelector(IERC20.transferFrom.selector, VICTIM, address(this), amount), deadline)` with zero WBNB input.
3. The aggregator executes the malicious calldata on USDT, spending the victim's allowance to transfer USDT to the helper.
4. Helper transfers stolen USDT to attacker.
**How found:** Likely identified that swapIn allowed arbitrary swapRouter and data, and that the aggregator had victim allowances, enabling arbitrary token transfers from victims.
**Exploitation:** Attacker called swapIn with zero input token amount and set swapRouter to USDT and data to transferFrom(victim, helper, amount). The aggregator, holding victim's USDT allowance, executed the call, transferring victim's USDT to the attacker's helper, which forwarded it to the attacker.
**Insight:** When a contract holds user token allowances, any function that lets the caller specify an arbitrary target and calldata can be abused to call transferFrom on those tokens. Check for such 'swap' or 'aggregator' functions that do not validate the target or ensure the call is a legitimate swap.