Primex Finance

The function _swapWithArbitraryDex(), although private, can be called indirectly by users with malicious inputs that are note validated properly. One of the inputs is _params.dexRouter which is used as the target address of an external function call, making it possible for a malicious user to craft arbitrary transactions with input parameters that could damage the entire protocol.There are multiple attack vectors associated with having this functionality enabled, mostly relating to the fact that it is possible for an attacker to impersonate the vulnerable smart contract. More specifically, it may be possible to drain the contract of all its funds, native or tokenized, as well as perform unauthorized actions acting as the DexAdapter. By taking into consideration the permissions and authorized actions that can be taken as DexAdapter, the impact may be more or less severe.As an example, the provided proof of concept can be used to drain the contract DexAdapter of all its NATIVE_CURRENCY. Furthermore, by using a combination of calls, delegate calls and reentrancy, a malicious smart contract may abuse the doApprove() function to gain access to tokens owned by DexAdapter.