# Unverified proxy 6f7a: missing access control drains victim token balances

Unverified proxy exposed selector 0xbfd479c4 without caller auth, letting attacker process victim's DAI/WETH/FEI balances and profit via flash swap.

- Payout: Real-world hack
- Severity: high
- Program: Unverified_6f7a
- Credited: DeFiHackLabs
- Disclosed: 2025-08-22
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-08/unverified_6f7a_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250822-unverified-6f7a
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Ethereum smart contract proxy (unverified implementation)
**Root cause:** Proxy exposed selector 0xbfd479c4 without caller authorization or a check that the token amount belonged to msg.sender, so any caller could process the victim contract's live token balances.
**Steps:**
1. Attacker calls `drainToken(DAI)` with 0.0033 ETH, swaps to 100 DAI, approves unverified router, then calls `VULNERABLE_CONTRACT.call(abi.encodeWithSelector(0xbfd479c4, address(this), [DAI], 0, victimBalance))`.
2. Repeat for WETH (deposit 100 wei) and FEI (swap 100 wei) to force each victim balance through the liquidity path.
3. Execute FEI/WETH flash swap borrowing 1,517,160,312,700,019,137,568 FEI from FEI-WETH pair.
4. In uniswapV2Call: approve FEI to SimpleFeiDaiPSM, redeem FEI for DAI sent to DAI-WETH pair, swap DAI for WETH out of DAI-WETH pair, repay FEI-WETH pair with WETH, send profit to attacker.
**How found:** Attacker likely noticed the unverified proxy exposed a selector (0xbfd479c4) that accepted an arbitrary token list and amount without checking msg.sender, then tested calling it with the victim contract's token balances.
**Exploitation:** Attacker used 0.01 ETH to trigger the vulnerable selector once per victim token (DAI, WETH, FEI), forcing the victim's balances through the unverified liquidity path. Then a FEI/WETH flash swap converted the resulting price imbalance into WETH profit, repaying the flash loan and sending ~0.24+ WETH to the attacker.
**Insight:** When a proxy points to an unverified implementation, enumerate exposed selectors and test whether they enforce msg.sender ownership on token amounts; a missing check lets you force a victim's balances through liquidity paths.