# BaseBebopSettlement: arbitrary external call drains approved tokens

Bebop settlement contract executed caller-supplied interactions, letting attacker call transferFrom on tokens where it had allowance, stealing ~$3.9k.

- Payout: Real-world hack
- Severity: high
- Program: BaseBebopSettlement
- Credited: DeFiHackLabs
- Disclosed: 2025-08-12
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/BaseBebopSettlement_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250812-basebebopsettlement
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:access-control vuln:business-logic

**Target:** Bebop settlement contract on Base
**Root cause:** The settlement contract accepted caller-controlled interaction calldata and executed arbitrary external calls, including token transferFrom, against accounts that had granted it allowance.
**Steps:**
1. Deploy attack contract on Base fork at block 34100255.
2. Build Order with maker/receiver/executor = attack contract, expiry = now+60, flags=1.
3. Construct two Interaction entries: target USDC, data `transferFrom(USDC_HOLDER, attack, 1e9)`; target victim token, data `transferFrom(VICTIM, attack, 901467122762682970176)`.
4. Call `settle(order, "", interactions, "", attack)` on 0xbeb0b0623f66bE8cE162EbDfA2ec543A522F4ea6.
5. Settlement executes both transferFrom calls, moving tokens to attacker.
**Exploitation:** Attacker called settle with crafted interactions array; the contract executed transferFrom on USDC and a victim token using existing allowances, transferring funds to the attacker contract.
**Insight:** Settlement/aggregator contracts that execute arbitrary interaction calldata are dangerous when they hold token allowances; check if interactions can target token contracts with transferFrom from any approved user.