# SiloFinance leverage helper arbitrary call drains borrower via fake flash loan

Silo leverage helper trusted user-supplied swap targets, letting an attacker route a fake flash-loan callback into the real WETH Silo's borrow to drain 224 ETH from a borrower.

- Payout: Real-world hack
- Severity: high
- Program: SiloFinance
- Credited: DeFiHackLabs
- Disclosed: 2025-06-25
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/SiloFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250625-silofinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** Silo leverage helper openLeveragePosition / ERC3156 flash-loan callback
**Root cause:** The leverage helper trusted user-supplied swap targets and Silo-like targets without constraining them to the selected Silo market, so a fake lender could supply swap data that made the helper call the real WETH Silo as an arbitrary exchange proxy.
**Steps:**
1. Deploy attack contract implementing flashLoan, asset, config, getSilos, balanceOf, allowance, approve, transferFrom, deposit, borrow to impersonate lender, silo, and token.
2. Call `openLeveragePosition(FlashArgs{flashloanTarget: attack, amount: 0}, '', DepositArgs{silo: attack, amount: 0, collateralType: 1})` on SILO_LEVERAGE_HELPER.
3. Helper calls attack.flashLoan; attack returns swapArgs with `exchangeProxy = WETH_SILO` and `swapCallData = abi.encodeWithSelector(ISilo.borrow.selector, 224 ether, profitReceiver, COLLATERAL_BORROWER)`.
4. Helper invokes onFlashLoan with encoded swapArgs+depositArgs; helper then executes the swap call against WETH_SILO, invoking `borrow(224 ether, attacker, COLLATERAL_BORROWER)`.
5. Real WETH Silo borrows against COLLATERAL_BORROWER's debt-receive approval to the helper, sending 224 WETH to attacker.
**Exploitation:** Attacker deployed a contract impersonating the flash lender, collateral silo, and collateral token, then called the public leverage helper. During the fake flash-loan callback the fake lender supplied swap data pointing exchangeProxy at the real WETH Silo with calldata for `borrow(224 ether, attacker, COLLATERAL_BORROWER)`. Because the borrower had granted the helper debt-receive approval, the real Silo executed the borrow and sent 224 WETH to the attacker.
**Insight:** When a helper contract accepts user-supplied 'exchange proxy' and 'silo' addresses, check whether it validates them against the selected market; a fake flash-lender callback can smuggle arbitrary calldata into a real Silo's borrow using any borrower's standing approval to the helper.