# CheckoutPool old BOC missing access control drains USDC

Old CheckoutPool bridge operator with _ALLOW_ALL_ lacked operator gate, letting anyone route bridge() into paymaster and drain 85,730 USDC from pool excess.

- Payout: Real-world hack
- Severity: high
- Program: unverified
- Credited: DefimonAlerts
- Disclosed: 2026-03-16
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/unverified_1304_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260316-unverified-1304
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:legacy-endpoint technique:source-review vuln:access-control vuln:business-logic

**Target:** Polygon smart contract bridge operator / ERC-4337 paymaster
**Root cause:** The old bridge operator contract (BOC) had _ALLOW_ALL_ enabled and no effective operator gate on bridge(), so any caller could invoke it. It forwarded calls into the trusted CheckoutPaymaster, which activated and called CheckoutPool.execute(), paying out the stored checkout target amount from pool USDC.
**Steps:**
1. Identify old BOC at `0x13046f513802De93f3fC48f0cDb2Cb7df22Ec01A` with `_ALLOW_ALL_() == true` and no operator check on `bridge()`.
2. Confirm BOC is an allowed operator on CheckoutPaymaster via `isOperatorAllowed(OLD_BOC)`.
3. Build a UserOperation whose hash matches the stored checkout `userOpHash` for attacker deposit address `0x9A5fe6e6A27f7eacE0782b89e6b216849d871E4f`.
4. Craft `BridgeParams` with target=CheckoutPaymaster, callData=`activateAndCall(CheckoutPool, execute(ATTACK_CONTRACT, ops))`.
5. Call `oldBoc.bridge(ATTACK_CONTRACT, bridgeParams)` from unprivileged EOA `0x6fF2bE5D0E5B3974a818731E3FF6EEEc8cd9D970`.
6. CheckoutPool.execute pays targetAmount USDC to attacker smart account, charging excess above heldAmount to pool excess.
**How found:** Likely spotted that an old BOC contract still had _ALLOW_ALL_ enabled and remained an allowed paymaster operator, then traced that bridge() had no caller gate and could be used to trigger CheckoutPool.execute() for an existing checkout.
**Exploitation:** Attacker called the unguarded old BOC bridge() with a crafted BridgeParams targeting the trusted CheckoutPaymaster. The paymaster's activateAndCall invoked CheckoutPool.execute() with a UserOperation matching the stored checkout hash, causing CheckoutPool to transfer the checkout targetAmount (85,730 USDC) to the attacker's smart account, consuming pool excess.
**Insight:** Look for deprecated/old operator contracts that retain allow-all flags and are still trusted by a paymaster; a missing caller check on their bridge/forward function can let anyone invoke privileged downstream execution paths.