# Bought/Purchased Token Can Be Sent To Attacker's Wallet Using 0x Adaptor

ZeroExAdapter ignored the vault address, letting any caller craft a 0x order with recipient set to themselves and steal the stETH sold during emergency settlement.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/75
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ZeroExAdapter in leveraged-vaults trading adapters
**Root cause:** ZeroExAdapter.getExecutionData ignores the `from` (vault) address and passes attacker-supplied exchangeData straight to the 0x proxy, so the order's recipient field is never validated against the vault.
**Steps:**
1. Call permissionless `settleVaultEmergency` on a vault with excess BPT.
2. Supply a `Trade` whose exchangeData targets 0x proxy with selector `sellToLiquidityProvider` (0xf7fcd384) or `sellTokenForTokenToUniswapV3` (0x6af479b2).
3. Set `recipient` to attacker address and `minBuyAmount`/`minBuyAmount` to 1 wei.
4. Vault approves stETH to 0x proxy and executes the order; output WETH is sent to attacker instead of vault.
**How found:** Compared all five DEX adapters and noticed Curve/Balancer/UniV2/UniV3 force `from` as recipient, while ZeroExAdapter ignores `from` entirely; then reviewed 0x feature functions to find recipient-controllable ones.
**Exploitation:** Attacker crafts a 0x order via the adapter's unvalidated exchangeData, sets recipient to their own wallet and minBuyAmount to 1 wei, then triggers settleVaultEmergency so the vault sells its stETH for WETH directly into the attacker's address.
**Insight:** When auditing DEX adapter libraries, diff each adapter's handling of the `from`/recipient parameter — any adapter that forwards raw user calldata to a router with a recipient field is a candidate for output redirection.