# Unvalidated callback or handler address trusted

Guard, callback, or helper addresses accepted without checking the implementation behind them

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-06-25. Updated 2026-11-02._

## How it works
A contract accepts an address that will later be called back into (a fallback handler, a callback interface, a swap or flash-loan target) and checks only a shallow signal: that a selector is blocked, that a boolean function returns true, or that the address was supplied by the caller. The assumption that breaks is "if the address passes this check, it is the kind of contract we expect." It is not. The address can be any contract the attacker controls, or a real contract used in a role it was never meant to fill, and the later call dispatches to it with the caller's authority [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md).

## Where it shows up
- Guard/hook allowlists that block dangerous selectors but not the arguments of allowed-but-sensitive functions (setFallbackHandler, delegatecall targets, module addresses) [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md)
- Interface checks of the form `X(msg.sender).isX()` that only prove one function returns true [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)
- Ownership or loan transfers that carry a capability flag (callback=true) to a new address without re-validating it [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)
- Helper contracts taking user-supplied "exchange proxy", "silo", or swap-target addresses [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md)
- Flash-loan callbacks where the lender address is not pinned to a known set [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md)

## How to review
For every address that will be called later, find the exact property that must hold and check it is enforced at the point of use, not just at entry:
- Is the address constrained to a known/expected set, or to the specific market/asset selected? [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md)
- Does the check verify the full interface (all required callbacks), or only a boolean? [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)
- Do transfer/ownership paths re-run validation on the new holder? [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)
- For selector blocklists: are the arguments of allowed sensitive functions validated, not just the selector? [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md)
The invariant: any address reachable as a call target must be either fixed by the protocol or validated against the exact role it will play.

## How finders spotted it
- Read Guard.sol's selector blocklist, saw setFallbackHandler checked for selector but not handler address, then reasoned about Gnosis Safe fallback dispatch forwarding unknown calldata to the handler [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md)
- Read clearRequest's isCoolerCallback check, noticed it only verifies a boolean-returning function, then reviewed transferOwnership preserving the callback flag without re-validation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)

## Variants seen
- Fallback handler pointed at the rented NFT contract to hijack it [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md)
- Stub contract or ownership transfer bypassing a callback interface check, omitting onRepay/onRoll so the loan defaults [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md)
- Fake flash-loan callback routed through a trusted helper into the real Silo to drain a borrower [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md)

## Impact and severity
High: theft of borrowed NFTs [E1](https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md), collateral seizure via forced default [E2](https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md), and a 224 ETH drain from a borrower [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md). Impact rises when the trusted address is a real protocol contract (the helper calls the genuine Silo), because the call carries legitimate authority and is hard to distinguish from normal use [E3](https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-01-renft%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-4.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250625-silofinance.md