# Adversary can overwrite function selector in _patchAmountAndCall due to inline assembly lack of overflow protection

Inline assembly mul overflow in _patchAmountAndCall lets attacker pick swapAmountInDataIndex to overwrite the calldata function selector and call unintended functions.

- Payout: Contest reward
- Severity: medium
- Program: Real Wagmi
- Credited: 0x52
- Disclosed: 2023-10-07
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-real-wagmi-judging/issues/82
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-real-wagmi%3AM-3
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:memory-corruption

**Target:** Solidity library ExternalCall.sol _patchAmountAndCall inline assembly
**Root cause:** swapAmountInDataIndex is multiplied by 0x20 inside YUL without overflow checks, so a crafted index wraps the offset and writes swapAmountInDataValue over the 4-byte function selector at ptr.
**Steps:**
1. Identify _patchAmountAndCall writing swapAmountInDataValue at `ptr + 0x24 + swapAmountInDataIndex*0x20` via `mstore` in inline assembly.
2. Choose swapAmountInDataIndex = k*2**251 - 2 so that index*0x20 ≡ -64 mod 2**256, landing the write at ptr (selector).
3. Control swapAmountInDataValue by creating a token and seeding a UniV3 LP pair so the computed swap amount equals the desired selector value.
4. Trigger the patched external call; the overwritten selector invokes an unintended/dangerous function on target.
**How found:** Code review of inline assembly in ExternalCall.sol; noticed YUL lacks overflow checks and that mul(swapAmountInDataIndex,0x20) can wrap, defeating the 0x24 offset intended to protect the selector.
**Exploitation:** Attacker supplies a crafted swapAmountInDataIndex and manufactures swapAmountInDataValue via a self-created UniV3 LP token, causing memory corruption that rewrites the function selector and bypasses selector restrictions to call arbitrary functions.
**Insight:** When auditing YUL mstore offsets, check whether index*stride can wrap mod 2**256 to a small negative offset that lands on the selector or length field; a self-controlled LP token can make computed amounts attacker-chosen.