Uniswap V4 router exploited for $42.6K via ABI encoding bypass that circumvented authorization checks.
Security & Exploits ·
A Uniswap V4 router implementation has been exploited for $42.6K through a flaw in its authorization mechanism. The vulnerability affected UniswapV4Router04, which used inline assembly to verify that the swap initiator matched the transaction sender by reading a hardcoded calldata offset. An attacker circumvented this check by crafting non-standard but valid ABI-encoded data with an alternate offset, allowing them to pass authorization while directing the actual swap through victim-controlled parameters.
The attack drained 42,607 USDC from an EIP-7702 delegated EOA that had granted approval to the router, converting it to 21.2 ETH via the ETH/USDC pool. The router contract cannot be paused or upgraded, leaving the exploit permanently on-chain. Users with existing approvals to the affected contract have been advised to revoke them immediately.
The vulnerability stemmed from an assumption that standard ABI encoding would always place the bytes parameter at a fixed offset (0x40), creating a gap between the authorization check location and the actual decoded data. The router developer has been contacted but the immutable nature of the contract means no remediation is possible.