# AllowanceTarget approval drain via authorized spender helper

Attacker abused an authorized spender contract to drain victim AllowanceTarget approvals, stealing 229K USDT via Curve and Uniswap swaps.

- Payout: Real-world hack
- Severity: high
- Program: Unverified_a152
- Credited: DeFiHackLabs
- Disclosed: 2026-04-27
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/unverified_a152_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Ethereum smart contract (AllowanceTarget and spender helper)
**Root cause:** The authorized spender contract (0xa152...) and its helper (0xfc40...) allowed arbitrary spendFromUser calls, letting an attacker reuse victim approvals to AllowanceTarget.
**Steps:**
1. Identify victims with USDT/stETH/aUSDT approvals to ALLOWANCE_TARGET (0x2990...).
2. For each victim, call `ISpenderHelper(SPENDER_HELPER).spendFromUser(owner, token, amount)` pranked as AUTHORIZED_SPENDER (0xa152...).
3. For aUSDT, withdraw from Aave V2 pool to convert to USDT.
4. Transfer drained tokens from AUTHORIZED_SPENDER to attack coordinator.
5. Swap stETH to ETH on Curve stETH pool.
6. Wrap ETH to WETH and swap WETH to USDT on Uniswap V3.
7. Transfer consolidated USDT to attacker.
**How found:** Attacker likely noticed that the authorized spender contract could be invoked by anyone to call spendFromUser on behalf of victims who had approved AllowanceTarget.
**Exploitation:** Attacker called the helper contract as the authorized spender to spend victims' allowances, then converted assets to USDT via Curve and Uniswap V3, netting 229K USDT.
**Insight:** Look for spender/helper contracts that lack access control on functions spending from user allowances; any caller can impersonate the authorized spender if the contract does not verify msg.sender.