# PerpDespository#reblance and rebalanceLite can be called to drain funds from anyone who has approved PerpDepository

Unpermissioned rebalance in PerpDepository accepts arbitrary payer address and swap params, letting attacker sandwich the swap and drain any user's allowance.

- Payout: Contest reward
- Severity: high
- Program: Uxd
- Credited: kankodu
- Disclosed: 2022-12-27
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/288
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** PerpDepository rebalance/rebalanceLite swap functions
**Root cause:** rebalance is unpermissioned and takes a caller-supplied `account` used as the payer for the shortfall, plus caller-controlled swap params, so anyone can force any approver to pay.
**Steps:**
1. Victim (multisig) approves PerpDepository for quoteToken (e.g. 1000 USDC) anticipating a shortfall.
2. Attacker calls `rebalance(amount, amountOutMinimum, sqrtPriceLimitX96, swapPoolFee, -1, victim)` with malicious swap params.
3. Attacker sandwiches the spot swap so quoteAmountOut is minimized, creating a large shortFall.
4. Contract executes `IERC20(quoteToken).transferFrom(victim, address(this), shortFall)`, consuming victim's allowance.
**How found:** Code review: noticed `account` parameter flows directly into `transferFrom` in `_rebalanceNegativePnlWithSwap` while the function is unpermissioned and swap params are caller-controlled.
**Exploitation:** Attacker front-runs/back-runs the spot swap to skew price, sets amountOutMinimum and pool params to maximize shortfall, and names the victim as `account`; the shortfall transferFrom drains the victim's approved quoteToken.
**Insight:** In unpermissioned functions that pull funds via transferFrom, check whether the payer address is caller-supplied rather than msg.sender; combined with caller-controlled swap params this turns any outstanding allowance into a theft primitive.