# Kame AggregationRouter: arbitrary external call drains USDC approvals

Kame AggregationRouter swap() passed attacker-controlled executeParams to an arbitrary executor, letting anyone call transferFrom on a victim's USDC approval and steal 18,167 USD.

- Payout: Real-world hack
- Severity: high
- Program: Kame
- Credited: DeFiHackLabs
- Disclosed: 2025-09-13
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-09/Kame_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250913-kame
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AggregationRouter swap() on Sei
**Root cause:** swap() accepts an arbitrary executor address and executeParams, then performs a low-level call to that executor with the supplied calldata without validating the target or selector.
**Steps:**
1. Identify victim `0x9A9F...Ab50` with USDC approval to router `0x14bb...4d80`.
2. Build SwapParams: srcToken=dstToken=syUSD, amount=0, executor=victim USDC token address.
3. Set executeParams=`transferFrom(victim, attacker, victimBalance)`.
4. Call `router.swap(params)`; router low-level calls USDC.transferFrom pulling victim's USDC to attacker.
**Exploitation:** Attacker calls swap() with executor set to the USDC token contract and executeParams encoding transferFrom(victim, attacker, fullBalance). The router's arbitrary external call executes transferFrom using the victim's existing allowance to the router, moving all USDC to the attacker in one transaction.
**Insight:** In aggregator/router contracts, any user-supplied executor plus calldata is a direct arbitrary-call primitive; check whether existing user approvals to the router can be abused via transferFrom on tokens.