Liquidity Management

#assembly-parsing, #hardcoded-offsets

Summary

The ParaSwapUtils.swap function relies on fixed byte offsets in assembly to parse critical parameters (fromToken and fromAmount), enabling attackers or misconfigurations to inject malicious values and trigger unintended token approvals.

Vulnerability Details

The library enforces a rigid assumption that the callData contains fromToken and fromAmount at exact byte positions (68 and 100) within an assembly block. This approach fails to verify the actual structure or format of the callData. Attackers or uncoordinated updates to the ParaSwap aggregator interface can shift these parameters or repurpose the bytes at those offsets. The contract then approves tokens that were never intended, breaking the principle of secure and predictable on-chain operations. A malicious or malformed callData results in the contract granting the ParaSwap proxy an allowance over arbitrary tokens and amounts, exposing user funds to unauthorized transfers.

Impact

Impact: Medium. An attacker can manipulate the assembly offsets to swap or approve tokens not originally intended by the contract. This flaw endangers the integrity of the token-approval process.

Likelihood: Medium. The aggregator often reverts on malformed calls, but partial or malicious aggregator changes, or carefully crafted calls, bypass this defense and cause unintended approvals. The input is expected from a trusted aggregator, but the current approach does not enforce this at the code level.

Tools Used

The attacker or a misconfigured system crafts callData with different byte layouts than the library expects.

They position a malicious token address at byte offset 68 and a high fromAmount at byte offset 100.

The function calls:

This produces unintended values for fromToken and fromAmount. The library proceeds with: IERC20(fromToken).safeApprove(approvalAddress, fromAmount); granting the aggregator an allowance over a token and amount the contract never intended to approve.

Recommendations

Eliminate hardcoded offsets and use ABI decoding to parse callData according to the aggregator’s official interface.