# SizeCredit: arbitrary call in leverageUpWithSwap drains victim allowance

SizeCredit's leverageUpWithSwap lacked validation of swap data, letting an attacker craft a malicious GenericRoute call to steal a victim's wstUSR allowance.

- Payout: Real-world hack
- Severity: high
- Program: SizeCredit
- Credited: DeFiHackLabs
- Disclosed: 2025-08-15
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/SizeCredit_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250815-sizecredit
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high technique:source-review vuln:access-control vuln:business-logic

**Target:** LeverageUp contract (leverageUpWithSwap) on Ethereum mainnet
**Root cause:** leverageUpWithSwap passed user-supplied swap data to a generic route executor without validating the target or calldata, allowing arbitrary external calls.
**Steps:**
1. Identify victim with wstUSR balance and allowance to LeverageUp contract.
2. Build SellCreditMarketParams with max values and SwapParams using SwapMethod.GenericRoute.
3. Craft data: `abi.encode(32, PT_WSTUSR, address(this), abi.encodeWithSelector(transferFrom, VICTIM, address(this), amount))`.
4. Modify byte at offset 127 from 0x80 to 0x60 to adjust ABI encoding for the generic route.
5. Call `leverageUpWithSwap(address(this), marketParams, address(this), 0, 1 ether, 0, swapParams)`.
6. The contract executes the embedded transferFrom, pulling victim's wstUSR to attacker.
**Exploitation:** Attacker called leverageUpWithSwap with a malicious GenericRoute swap payload that encoded a transferFrom call from the victim to the attacker, exploiting the victim's existing allowance to the LeverageUp contract. The attacker used a crafted ABI encoding (changing 0x80 to 0x60) to make the generic route executor perform the transfer.
**Insight:** When a contract offers a 'generic route' or arbitrary call feature, check if user-controlled data can specify the target and calldata; even without direct approval, existing allowances to the contract can be abused.