# Standing allowance drained via helper

Permissionless or caller-steered path reaching transferFrom on a contract holding user approvals

_Area: Smart contract access control and control flow. Seen in 34 disclosed reports; one confirmed bounty: $25,000; latest 2026-04-28. Updated 2026-10-23._

## How it works
A contract holds a standing ERC20 allowance from a victim. The broken assumption is that only the intended flow (swap, fill, settlement) can reach `transferFrom`. Two doors let an attacker spend it: (1) the payer (`from`) is caller-chosen or synthesized rather than bound to `msg.sender`; (2) the contract executes attacker-supplied target+calldata, so the contract itself calls `transferFrom` against its own approvals. A related sub-case grants the attacker future approval rights rather than draining directly.

## Where it shows up
- Functions taking user-supplied calldata plus an arbitrary target, executed by the contract [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-zapper-arbitrary-call-data-bugfix-review.md).
- Permissionless entrypoints (`run`, `multicall`, `performUpkeep`) on contracts holding approvals [E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-5.md)[E8](https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain.md).
- `transferFrom`/`safeTransferFrom` where `from` comes from a parameter not checked against `msg.sender` [E4](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AH-04.md).
- `type(uint256).max` approvals to a spender that also exposes arbitrary calls [E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-5.md).
- Marketplace approvals spendable by a second path that skips settlement [E2](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-08.md).
- Spender/helper contracts with no access control on functions spending user allowances [E7](https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152.md).
- ERC4626 overrides that skip allowance spending [E6](https://bugbountylibrary.com/r/dhl%3A20260428-rwavault.md).

## How to review
Grep for functions taking `(target, calldata)` or a `from`/`owner`/`payer`/`coinbase` parameter, and for every `transferFrom`/`approve` reachable from them. Invariant: the `from` address must equal `msg.sender` (or a value the caller is authorized to act for), and target/calldata must be constrained to the intended operation. For ERC4626 forks, diff each overridden `withdraw`/`redeem` against the spec: when `msg.sender != owner`, a `_spendAllowance(owner, msg.sender, amount)` must run before transfer [E6](https://bugbountylibrary.com/r/dhl%3A20260428-rwavault.md). Check approvals are exact-amount and cleared, and that no helper is callable by anyone to spend another party's approval [E7](https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152.md)[E8](https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain.md).

## Variants seen
- Arbitrary calldata forwarded to a pool, smuggling `transferFrom` [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-zapper-arbitrary-call-data-bugfix-review.md).
- Max allowance to a spender with an arbitrary-call primitive; the spender points the call at the token [E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-5.md).
- Permissionless multicall/router spending victim approvals [E8](https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain.md).
- Caller-chosen payer field pulled via `safeTransferFrom` [E4](https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AH-04.md).
- Alternate path spends a granted approval without settlement [E2](https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-08.md).
- Unauthenticated spender helper reusing victim approvals [E7](https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152.md).
- Missing allowance check in an ERC4626 override [E6](https://bugbountylibrary.com/r/dhl%3A20260428-rwavault.md).

## Impact and severity
Direct theft of approved funds: 229K USDT [E7](https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152.md), ~$800K at risk [E8](https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain.md), ~398k USDC [E6](https://bugbountylibrary.com/r/dhl%3A20260428-rwavault.md), ~$40m [E3](https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-5.md). High severity; worse when approvals are unlimited and the helper is permissionless. E6/E7/E8 are 2026-dated and lower-confidence.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-zapper-arbitrary-call-data-bugfix-review.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-10-coded-estate%3AH-08.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-11-oku%3AH-5.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-03-taiko%3AH-04.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-1.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260428-rwavault.md
- E7: https://bugbountylibrary.com/r/dhl%3A20260427-unverified-a152.md
- E8: https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain.md