# 0x8d2e: missing access control in Uniswap callback drains USDC

0x8d2e contract's uniswapV3SwapCallback lacked access control, letting anyone drain all USDC by specifying recipient in callback data.

- Payout: Real-world hack
- Severity: high
- Program: 0x8d2e
- Credited: DeFiHackLabs
- Disclosed: 2025-08-20
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/0x8d2e_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250820-0x8d2e
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Uniswap V3 swap callback function in a smart contract
**Root cause:** The uniswapV3SwapCallback function is externally callable and does not verify that the caller is a legitimate Uniswap pool or that the swap was initiated by the contract, allowing arbitrary callers to specify a recipient and amount.
**Steps:**
1. Identify victim contract `0x8d2Ef0d39A438C3601112AE21701819E13c41288` on Base holding USDC.
2. Call `uniswapV3SwapCallback(int256(balance), 0, abi.encode(USDC_ADDR, attackerAddress))` directly from an attacker contract.
3. The callback transfers the specified amount of USDC to the address encoded in `data`.
**Exploitation:** Attacker calls the vulnerable callback with the victim's USDC balance as amount0Delta and encodes their own address as recipient, causing the contract to transfer all USDC to the attacker.
**Insight:** Uniswap V3 callbacks must verify msg.sender is the expected pool and that the call originates from a legitimate swap; otherwise anyone can invoke the callback to move funds.