# Adversary manipulate the middle path when calling `execute_dca_order`, resulting user loss, benefiting the attacker

Anyone can call execute_dca_order with an arbitrary _uni_hop_path; attacker inserts their own token as middle hop to skew swap price and drain user value.

- Payout: Contest reward
- Severity: high
- Program: Unstoppable
- Credited: 0xDjango
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/182
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Dca.vy execute_dca_order Uniswap V3 swap path
**Root cause:** execute_dca_order accepts a caller-supplied _uni_hop_path and only validates endpoints (token_in/token_out), not intermediate tokens; min_amount_out is computed from the same attacker-supplied path via TWAP.
**Steps:**
1. Attacker deploys MYTOKEN and seeds Uniswap V3 liquidity with extreme price ranges.
2. Victim posts DCA order USDC->WETH via post_dca_order with min_amount_out from _calc_min_amount_out.
3. Attacker calls `execute_dca_order(uid, [USDC, MYTOKEN, WETH], [fee1, fee2], share_profit)` inserting MYTOKEN as middle hop.
4. Contract builds path `USDC|fee1|MYTOKEN|fee2|WETH` and calls UniswapV3SwapRouter.exactInput.
5. Skewed MYTOKEN pool yields unfair rate; attacker profits from the distorted pool, victim loses value.
**How found:** Code review of execute_dca_order: noticed _uni_hop_path is caller-controlled and only endpoint tokens are asserted, so intermediate hop is unconstrained; also noted TWAP/last_execution/seconds_between_executions are predictable, enabling pre-attack pool setup.
**Exploitation:** Attacker pre-creates and seeds a malicious token pool, then calls execute_dca_order with a crafted _uni_hop_path routing the victim's USDC through their token before WETH, capturing value via the manipulated pool pricing.
**Insight:** When a swap executor accepts a caller-supplied multi-hop path, validate every intermediate token against a whitelist or derive the path internally; endpoint-only checks let attackers inject their own token as a middle hop.