# Unvalidated flash-loan callback trust

Callbacks that trust caller-supplied params or initiator instead of proving the loan was self-initiated

_Area: DeFi oracles, liquidations and flash loans. Seen in 14 disclosed reports; one confirmed bounty: $60,000; latest 2025-07-26. Updated 2026-10-23._

## How it works
A flash-loan callback (`executeOperation`, `receiveFlashLoan`, a UniswapV2 swap callback, or a custom `flashloanReq`) runs attacker-reachable code while borrowed funds are outstanding. The contract assumes the callback only fires for a loan it started, with parameters it chose. When it instead trusts `msg.sender` alone, or nothing, or accepts caller-supplied amounts/fees/receiver/calldata, an attacker triggers the callback directly or through a lender and makes the victim repay, redeem collateral, or move funds on the attacker's terms.

## Where it shows up
- Callback functions callable by anyone, or checking only `msg.sender == lendingPool` without an initiator/self-initiated flag [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-logic-error-bugfix-review.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-02.md).
- Caller-supplied `_amount`, `_fee`, `receiver`, `account`, manager addresses, or `swapData` used without matching them to the loan [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-logic-error-bugfix-review.md)[E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-02.md)[E4](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md)[E8](https://bugbountylibrary.com/r/dhl%3A20240329-prisma.md).
- Unverified proxies forwarding a lender callback without origin validation [E2](https://bugbountylibrary.com/r/dhl%3A20250726-unverified670471.md).
- UniswapV2 callbacks not checked against a factory-derived pair [E6](https://bugbountylibrary.com/r/dhl%3A20250726-unverified6883.md).
- Allowance checked against `address(this)` rather than `msg.sender` in mint/burn flash designs [E5](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-15.md).
- Flash-loan burn paths that skip freeze/balance state updates, leaving burned tokens usable [E7](https://bugbountylibrary.com/r/dhl%3A20241022-vista.md).

## How to review
The invariant: a callback must only execute for a loan this contract itself initiated, with parameters it set. Check for a transient/self-initiated flag set before the borrow and cleared after (and reset on revert), or `initiator == address(this)`; verify `msg.sender` is the expected lender (and, for UniswapV2, a known factory-derived pair); confirm every param used in the callback (amount, fee, receiver, calldata) is validated against the loan, not taken from the caller. For mint/burn designs, allowance must run from receiver to `msg.sender` (e.g. the receiver approves the caller, not the token contract). Note false positives: routers and aggregators legitimately accept caller params, so require the self-initiation proof only where the callback moves protocol-owned funds.

## Variants seen
- Anyone-callable strategy flashloan with attacker `_amount`/`_fee` bypassing the balance check [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-logic-error-bugfix-review.md).
- Forwarded Balancer callback with no caller/origin validation [E2](https://bugbountylibrary.com/r/dhl%3A20250726-unverified670471.md).
- Aave `executeOperation` missing initiator check, arbitrary params and swap data [E3](https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-02.md).
- Unvalidated `flashloanReq` params and swapData enabling sensitive calls [E4](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md).
- Caller-chosen receiver drained via its allowance [E5](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-15.md).
- Fake UniswapV2 pair callback trusted [E6](https://bugbountylibrary.com/r/dhl%3A20250726-unverified6883.md).
- Burn-without-freeze leaving borrowed tokens spendable [E7](https://bugbountylibrary.com/r/dhl%3A20241022-vista.md).
- Callback trusting arbitrary calldata for trove operations [E8](https://bugbountylibrary.com/r/dhl%3A20240329-prisma.md).

## Impact and severity
Losses ranged from ~$1k [E6](https://bugbountylibrary.com/r/dhl%3A20250726-unverified6883.md) to ~$11M [E8](https://bugbountylibrary.com/r/dhl%3A20240329-prisma.md), with $1.8M [E4](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md) and 19 wBTC/$635k [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-logic-error-bugfix-review.md). Severity is critical when the callback can move or redeem protocol funds; worse when params are fully attacker-controlled and no initiator check exists.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-mushrooms-finance-logic-error-bugfix-review.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250726-unverified670471.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-02.md
- E4: https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-15.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250726-unverified6883.md
- E7: https://bugbountylibrary.com/r/dhl%3A20241022-vista.md
- E8: https://bugbountylibrary.com/r/dhl%3A20240329-prisma.md