# All funds can be stolen from JOJODealer

Funding._withdraw makes an arbitrary call to a user-supplied `to` address with user calldata, letting an attacker invoke USDC transferFrom and drain all JOJODealer funds.

- Payout: Contest reward
- Severity: high
- Program: Jojo Exchange Update
- Credited: 0x52
- Disclosed: 2023-12-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-12-jojo-exchange-update-judging/issues/7
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-jojo-exchange-update%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** EVM smart contract withdraw function (Funding library)
**Root cause:** _withdraw executes `to.call(param)` with fully user-controlled target and calldata whenever param is non-empty, only requiring `to` be a contract. No whitelist or selector restriction.
**Steps:**
1. Call `executeWithdraw(from, to, isInternal, param)` with `to` = USDC token contract address
2. Set `param` to ABI-encoded `transferFrom(victim, attacker, amount)` or equivalent token call
3. Withdraw 1 wei so param.length != 0 triggers the arbitrary `to.call(param)`
4. USDC contract executes the encoded transfer, moving JOJODealer-held tokens to attacker
**How found:** Code review of the withdraw path: noticed `to.call(param)` with user-controlled `to` and `param`, only guarded by isContract, and reasoned the target could be the token contract itself to invoke transferFrom.
**Exploitation:** Attacker triggers a minimal withdrawal to satisfy the param-length check, then the contract itself calls the token contract with attacker-supplied calldata, executing transferFrom against JOJODealer's balance and sending all funds to the attacker.
**Insight:** When a contract performs `target.call(userData)`, check whether the target can be a token/asset contract the protocol already holds approvals or balances with — turning the call into a self-authorized transferFrom.