Submitted by WatchPug, also found by catchup, csanuragjain, rayn, and VAD37
AnyswapFacet.sol#L131-L157
LibAsset.sol#L59-L70
In the AnyswapFacet.sol, _anyswapData.router is from the callers calldata, which can really be any contract, including a fake Anyswap router contract, as long as it complies to the interfaces used.
And in _startBridge, it will grant infinite approval for the _anyswapData.token to the _anyswapData.router.
This makes it possible for a attacker to steal all the funds from the contract.
Which we explained in #159, the diamond contract may be holding some funds for various of reasons.
Given:
There are 100 USDC tokens in the contract.
H3xept (Li.Fi) acknowledged, but disagreed with High severity and commented:
gzeon (judge) decreased severity to Medium and commented:
