# Caller-supplied contract address trusted

Liquidation or swap entrypoints taking router, market, reserve or hop addresses without registry validation

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2026-03-24. Updated 2026-11-01._

## How it works
A function needs to talk to another contract — a market, a reserve vault, a router, a swap path — and takes that address from the caller instead of from its own registry. The code then trusts whatever that contract returns: a price, a cost, a balance, a swap amount. An attacker deploys a contract that answers with whatever value suits them (zero cost, inflated collateral, skewed price) and the protocol acts on it as if it were the real market. The broken assumption is that an address parameter identifies a protocol-owned contract; nothing enforces that.

## Where it shows up
- Liquidation functions with a market/reserve/oToken/vault address parameter (`liquidateWithSingleRepay`, `liquidateUser`) [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)[E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md)
- Swap executors taking a multi-hop path where only the first and last token are checked [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md)
- Token helpers taking `router`/`pair`/`lpr` addresses from the caller [E4](https://bugbountylibrary.com/r/dhl%3A20230606-vinu.md)
- Return values from the caller-supplied contract used directly in cost, collateral or price math [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)[E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md)
- Collateral or token IDs taken from the real protocol while the price/cost comes from the fake contract [E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md)

## How to review
For every external address parameter, ask: is this checked against a protocol-owned registry, factory, or an internally derived value? The invariant: any contract whose return values affect accounting must be one the protocol itself selected, not one the caller named. Check that endpoint-only validation of a path is not treated as sufficient — every intermediate hop must be whitelisted or the path derived internally [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md). Check that the same contract supplying the price also owns the asset being moved; a mismatch between the real collateral source and the caller-supplied pricer is the tell [E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md).

## How finders spotted it
- Read the liquidation function and saw it accepts arbitrary oToken addresses and trusts their returned balances, so a fake contract could spoof values and bypass checks [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)
- Code review of `execute_dca_order`: `_uni_hop_path` is caller-controlled and only endpoint tokens are asserted, leaving the middle hop free; also noticed TWAP and execution timing were predictable enough to pre-set a pool [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md)

## Variants seen
- Fake oToken markets in a single-repay liquidation, manipulating exchange rate [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md)
- Fake reserve returning zero liquidation cost while real collateral token IDs move [E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md)
- Attacker-owned middle hop in a Uniswap V3 DCA path [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md)
- Fake router/pair in a token's addLiquidityETH helper [E4](https://bugbountylibrary.com/r/dhl%3A20230606-vinu.md)

## Impact and severity
Direct fund loss from protocol or user balances: >$3.8M across several assets in one transaction [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md), 3.25 cbETH + 0.22 WETH seized from multiple victims [E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md), user value drained via skewed swaps [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md), ~$6k profit [E4](https://bugbountylibrary.com/r/dhl%3A20230606-vinu.md). Impact scales with how much collateral the entrypoint can move and whether the fake contract can be looped across victims [E2](https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md); chaining a flash loan and exchange-rate manipulation widened the drain to multiple markets atomically [E1](https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20240926-onyxdao.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260324-xocolatlliquidator.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AH-7.md
- E4: https://bugbountylibrary.com/r/dhl%3A20230606-vinu.md