# Router.sol is vulnerable to address collission

KyberSwap Router's swapCallback only checks msg.sender against a computed create2 pool address without verifying the pool exists, enabling a 2^81 address-collision attack to drain all token allowances to the router.

- Payout: Contest reward
- Severity: medium
- Program: Kyber Swap
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-07-kyber-swap-judging/issues/90
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-kyber-swap%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Router.sol swapCallback / _getPool create2 address check
**Root cause:** swapCallback verifies msg.sender equals PoolAddress.computeAddress(factory, tokenA, tokenB, fee, poolInitHash) but never confirms with the factory that such a pool actually exists, so any EOA whose address collides with a computed pool address for a chosen token pair passes the check.
**Steps:**
1. Pick token0 = WETH (or any high-allowance token) and vary token1/fee to enumerate candidate pool addresses via PoolAddress.computeAddress.
2. Generate ~2^80 attacker-controlled EOA addresses and ~2^80 pool addresses; birthday bound gives ~86% collision at 2^81 total, ~99.96% at 2^82.
3. Deploy/fund the colliding EOA and call Router.swapCallback (or trigger a swap path invoking it) with tokenIn/tokenOut/fee matching the collided pool so msg.sender == computed pool address passes.
4. Router releases/transfers the approved tokens to the attacker-controlled address, draining all outstanding allowances for that token.
**How found:** Code review of Router.swapCallback noticed the msg.sender check relies solely on a locally computed create2 address with no factory existence check; reasoned about birthday-bound collision resistance of truncated keccak256 (2^160) and computed 2^81/2^82 work factors, then validated with a scaled-down collision PoC.
**Exploitation:** Attacker precomputes a collision between an EOA they control and a create2-derived pool address for a target token pair, then invokes the router callback from that EOA to satisfy the msg.sender check and pull all user allowances of the token to the router.
**Escalation:** Reuse the generated EOA set to halve cost of subsequent attacks on other tokens; immutable router means accrued approvals grow over time, increasing payoff.
**Insight:** When a contract authenticates a caller by recomputing a create2 address locally, check whether it also confirms the contract actually exists on-chain (EIP-684); if not, the effective security is only the birthday bound of the truncated hash, not preimage resistance.