# Attacker can steal the accumulated topup fees in the `topupproxy` contract's balance

Shared whitelist plus unlimited bridge allowance let an attacker route _bridgeTxData through 1inch to pull the topupproxy's accumulated fees to themselves.

- Payout: Contest reward
- Severity: high
- Program: Mover
- Credited: minhquanym
- Disclosed: 2022-10-11
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-10-mover-judging/issues/112
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-mover%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** HardenedTopupProxy / TopupProxy contract on Polygon
**Root cause:** The trustedregistry whitelist is shared between exchangeproxy and topupproxy, so the 1inch aggregator whitelisted for swaps is also callable as a bridge targetAddress; the proxy grants that targetAddress an unlimited allowance instead of just the current topup amount, and fees accumulate in the contract balance.
**Steps:**
1. Call `CardTopupPermit()` with `_token = cardTopupToken`, `_bridgeType = 0`.
2. Set `_bridgeTxData.targetAddress` to the whitelisted 1inch proxy (0x1111111254fb6c44bAC0beD2854e76F90643097d).
3. Craft 1inch swap calldata with `amount` = full topupproxy balance and `srcReceiver` = attacker address.
4. `_processTopup()` grants 1inch unlimited allowance and executes the swap, pulling all accumulated fees to the attacker.
**How found:** Code review of the deploy script revealed the same trustedregistry shared across exchangeproxy and topupproxy, so swap aggregators whitelisted for one are callable on the other; combined with the unlimited allowance at L414 and fees left in balance at L348-352.
**Exploitation:** Attacker submits a topup whose bridge target is the whitelisted 1inch AggregationRouterV4; the proxy approves it unlimited allowance, and 1inch's swap pulls the entire contract balance to the attacker-specified srcReceiver.
**Insight:** Check whether a shared whitelist/registry lets a contract intended for one role (swap aggregator) be invoked in another role (bridge target); any aggregator that lets the caller specify srcReceiver turns an unlimited approval into a full-balance drain.