# If oracle is set for ERC777 token, re-entrancy is possible to steal all LToken funds

ERC777 callback during Account.sweepTo lets attacker re-enter, borrow DAI, and have it swept out with all assets, leaving bad debt that drains LToken funds.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: panprog
- Disclosed: 2022-08-30
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/076-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** Account.sweepTo / AccountManager on lending protocol
**Root cause:** sweepTo transfers asset tokens (including ERC777 with receiver hooks) before clearing state and without reentrancy guards, so a hook can re-enter AccountManager to borrow against assets that are then swept away.
**Steps:**
1. OpenAccount
2. If ERC777 allowed as collateral, deposit imBTC; else deploy USDC-imBTC uni v2 pool, send LP tokens to account, call `AccountManager.exec` -> `removeLiquidity` (UniV2Controller lacks tokenIn allowlist check) to add USDC+imBTC to assets
3. Deposit `0 DAI` so DAI is last asset in sweepTo
4. Close account -> `sweepTo` transfers USDC then imBTC, triggering attacker `tokensReceived` hook
5. In hook: `openAccount` to regain access, deposit `1 ether`, borrow `4000 DAI`, exit
6. sweepTo sends 4000 DAI and 1 ether to user, deletes assets; account left with 0 assets and 4000 DAI debt
**How found:** Code review of sweepTo ordering and UniV2Controller.removeLiquidity: noticed removeLiquidity doesn't validate tokenIn allowlist (only addLiquidity does), enabling arbitrary tokens into assets, then reasoned ERC777 hooks fire during sweepTo transfers before state cleanup.
**Exploitation:** Attacker uses ERC777 receiver hook mid-sweepTo to re-open the account, deposit collateral, borrow DAI, then let sweepTo transfer borrowed DAI plus all assets out before health checks, leaving bad debt absorbed by LToken lenders. Repeat with USDC deposits to double counted balance and scale to millions.
**Escalation:** Re-deposit previously-swept tokens to double-count balance (hasAsset reset while still in assets list), and use ether swept last to borrow against; repeat loop to drain all borrowable LTokens.
**Insight:** When auditing sweep/withdraw loops, check whether any asset token can invoke a receiver hook (ERC777/ERC677) and whether state (assets list, hasAsset flags) is cleared only after all transfers; also check that removeLiquidity-style functions validate tokenIn the same way addLiquidity does, since LP tokens can be sent directly bypassing exec.