# PHyperLPoolSwapInside::_swapWithCustomData() should check if the router has code Low/Info · Three Sigma · DeFi infrastructure · 15th March 2024 Finding 3S-Clip-L06 of the Clip Finance Strategy Upgrade security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-strategy-upgrade - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-03-15-clip-finance-ii.pdf --- ### Description [PHyperLPoolSwapInside::_swapWithCustomData()](https://github.com/ClipFinance/StrategyRouter-private/pull/107/files#diff-023946f07f510e865612a28a9a222e00f0f6b90a253fd981e9bf4f7656f5497fR588) performs swap using a router provided as argument in swapData. Solidity performs contract length checks when using an interface, but not when using .call(), making this call dangerous as success will be true. ### Recommendation Use Openzeppelin's [Address::functionCall()](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L62) which performs all the checks. ### Status Addressed in [#0c8de23](https://github.com/ClipFinance/StrategyRouter-private/commit/0c8de23862d9fed65f3c1a3fc4eac9a0356ef76e#diff-023946f07f510e865612a28a9a222e00f0f6b90a253fd981e9bf4f7656f5497fR600). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Attacker may frontrun SyrupRouter::depositWithPermit() call and use a different depositData_ as it is not signed](https://0xsimao.com/findings/maple-finance-syrup-router-frontrun-deposit-permit-different): Maple Syrup Router - [In MapleGlobals, there is no check in the dataHash argument when unscheduling a call.](https://0xsimao.com/findings/maple-finance-iii-globals-hash-argument-unscheduling): Maple Finance - [Borrower deposit, withdraw, deposit will reinit `omniChainData.cdsPoolValue`, getting profit stuck for cds depositors](https://0xsimao.com/findings/autonomint-deposit-withdraw-reinit-stuck): Autonomint - [An attacker can manipulate `omniChainData.cdsPoolValue` by breaking protocol.](https://0xsimao.com/findings/autonomint-manipulate-omni-data-breaking): Autonomint