# Caller-controlled swap path and direction mask

Swap path, pool, or direction bits taken from caller and used unvalidated to route a swap

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2025-08-04. Updated 2026-10-30._

## How it works
The contract trusts the caller to say *where* the swap goes. A path array, pool address, or direction bitmask arrives as a parameter and is used directly to build the swap target or route, instead of being checked against a fixed allowlist. The assumption that breaks is "the caller can only choose among pools/routes the contract already trusts." Once the caller can steer the route, they can point it at a pool they control, or at tokens they control, and the contract's own funds flow through it. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md)

## Where it shows up
- Public or externally callable swap/rebalance functions taking `path`, `pool`, `tokenIn/tokenOut`, or a `directionMask`/flags argument. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md)
- Address arithmetic like `pool = trustedPool | userMask` or any OR/AND of caller bits into an address. [E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md)
- Swaps that spend the contract's own token balance rather than a caller-supplied amount. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)
- Permission checks that gate *who* can call but not *what route* they pick. [E3](https://bugbountylibrary.com/r/dhl%3A20230618-ara.md)
- Tokens in the path that are attacker-deployable (fee-on-transfer, hooks, rebasing). [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)

## How to review
Find every swap call and trace each routing argument back to its source. The invariant: every pool address and every token in the path must come from contract state or a hardcoded allowlist, never from calldata, and any caller-supplied mask must be fully consumed by a strict equality check (e.g. `mask == BUY || mask == SELL`) before it influences an address. For OR-into-address patterns, confirm the mask cannot set bits outside the intended low bits, or that the result is re-validated against the trusted pool. Also confirm the swap amount is bounded and not the contract's whole balance. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md) For permissioned swaps, check that an approved caller cannot choose arbitrary execution prices. [E3](https://bugbountylibrary.com/r/dhl%3A20230618-ara.md)

## Variants seen
- Arbitrary token path plus contract's own WBNB balance, skewed by a fee-on-transfer token. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)
- Direction bitmask ORed into a trusted pool address, redirecting the swap to an attacker pool (address grinding via CREATE2). [E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md)
- Permission mishandling letting an approved address swap at manipulated prices, amplified by flash loan. [E3](https://bugbountylibrary.com/r/dhl%3A20230618-ara.md)

## Impact and severity
Direct fund loss from the contract's balance: ~700 USD in [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md), ~125k USD in [E3](https://bugbountylibrary.com/r/dhl%3A20230618-ara.md); profit capture from a depeg rebalancer in [E2](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md). Severity rises when the contract holds its own liquidity, when the route feeds a manipulable pool, and when flash loans let the attacker scale the skew within one transaction. [E1](https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md)[E3](https://bugbountylibrary.com/r/dhl%3A20230618-ara.md)

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20250804-bscinitcodetoken.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06.md
- E3: https://bugbountylibrary.com/r/dhl%3A20230618-ara.md