# All allowances to DepositStableCoinToDealer and GeneralRepay can be stolen due to unsafe call

DepositStableCoinToDealer and GeneralRepay make an arbitrary external call, letting anyone invoke token contracts to drain allowances other users granted to the helper.

- Payout: Contest reward
- Severity: high
- Program: Jojo
- Credited: 0x52
- Disclosed: 2023-04-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-jojo-judging/issues/428
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity helper contracts (DepositStableCoinToDealer, GeneralRepay)
**Root cause:** The helper pulls funds then executes `swapTarget.call(data)` with no restriction on swapTarget or calldata, so the contract itself can be made to call any token contract.
**Steps:**
1. User A approves DepositStableCoinToDealer for 100 USDT
2. Attacker calls depositStableCoin with `param` decoding to swapTarget = USDT token address and data = `transferFrom(victim, attacker, allowance)`
3. Helper executes the call as itself, spending victim's allowance to attacker
**How found:** Code reading of the swap helper: noticed the decoded swapTarget and data are passed to a raw `.call` with no whitelist, then reasoned that the contract's own token approvals could be spent by anyone.
**Exploitation:** Attacker supplies the token contract as swapTarget and a transferFrom payload moving the victim's approved balance to themselves; the helper's own allowance is consumed.
**Insight:** In swap/repay helper contracts that hold user approvals, check whether swapTarget and calldata are attacker-controlled; if so, the helper can be turned into a confused deputy against any token a victim approved.