# Coinbase fee account approval exploited via 0x swapper

Coinbase fee account approved ERC-20 tokens to a 0x swapper allowing arbitrary calls; attacker drained 300k USD via transferFrom.

- Payout: Real-world hack
- Severity: high
- Program: Coinbase
- Credited: DeFiHackLabs
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/coinbase_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250813-coinbase
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:recon vuln:access-control vuln:misconfiguration

**Target:** 0x MainnetSettler swapper contract and Coinbase fee receiver account
**Root cause:** Coinbase fee account accidentally approved multiple ERC-20 tokens to a 0x swapper that permits arbitrary calls, enabling anyone to invoke transferFrom from the fee account.
**Steps:**
1. Identify Coinbase fee account `0x382fFCe2287252F930E1C8DC9328dac5BF282bA1` has token approvals to 0x MainnetSettler `0xDf31A70a21A1931e02033dBBa7DEaCe6c45cfd0f`.
2. Construct action calling `transferFrom(COINBASE_FEE, attacker, amount)` on token ANDY.
3. Wrap action in `buildData(0, 10000, ANDY, 0, COINBASE_FEE, attacker, amount)` with selector `0x38c9c147`.
4. Call `IMainnetSettler.execute(slippage, actions, "")` with minimal ETH.
5. Receive drained tokens.
**How found:** Attacker noticed the fee account's token approvals to the 0x swapper, likely via on-chain monitoring or block explorer inspection.
**Exploitation:** Attacker called the 0x settler's execute function with a crafted action that invoked transferFrom on the ANDY token, using the fee account's approval to transfer tokens to the attacker.
**Insight:** Monitor large token approvals to contracts that allow arbitrary calls; even fee accounts can leak funds if approvals are misconfigured.