# The pool verification in `NapierRouter` is prone to collision attacks

NapierRouter verifies callback callers by comparing truncated CREATE2 addresses, so a found basePool/underlying collision lets an attacker EOA drain all router token allowances.

- Payout: Contest reward
- Severity: medium
- Program: Napier
- Credited: Arabadzhiev
- Disclosed: 2024-01-24
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/111
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AM-12
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NapierRouter mintCallback/swapCallback pool verification
**Root cause:** _verifyCallback compares msg.sender to a CREATE2 address computed from attacker-supplied basePool/underlying, truncating keccak256 to 160 bits; a colliding pair matching an attacker EOA passes the check.
**Steps:**
1. Find basePool/underlying pair whose computed CREATE2 address equals an attacker-controlled EOA (birthday collision over 160-bit space).
2. Call `swapCallback(underlyingDelta, ptDelta, data)` from that EOA with data encoding the colliding underlying/basePool and a SwapPtForUnderlyingData payload.
3. `_verifyCallback` passes since computed address == msg.sender.
4. Router executes `params.pt.safeTransferFrom(params.payer, msg.sender, uint256(-ptDelta))`, pulling approved tokens to attacker.
**How found:** Code review of _verifyCallback: noticed caller verification relies on truncated CREATE2 computation with attacker-controlled inputs rather than factory registry lookup; linked prior Kyberswap/Arcadia reports on 160-bit collision attacks.
**Exploitation:** Attacker precomputes a collision so their EOA matches the CREATE2 address derived from chosen basePool/underlying, then invokes the callback directly; the router's safeTransferFrom moves victim-approved tokens to the attacker EOA.
**Escalation:** Single collision drains all token allowances given to the router, since CREATE2 addresses are not computed from all token addresses.
**Insight:** When a contract authenticates callers by recomputing a CREATE2 address from calldata, check whether the inputs are attacker-controlled and the hash is truncated to 160 bits; a registry mapping check is collision-proof.