Arbitrary call with user-controlled target

Evidence summary #

V3 Pool callback pattern calls user-supplied swap/mint callee addresses for flash repayment verification — constrained by the lock() mutex ensuring invariants hold post-call. No unconstrained arbitrary call with user-supplied target and data detected. No auditor findings on this pattern across 6 firms covering the deployed code.

Sources #

Methodology #

Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.

See the full factor methodology and distribution across all protocols →