# BaseRouter, _bundleInternal(...) Action.Flashloan does not check if the selector matches xBundle(...) Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L04 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description Users make flashloans by calling xBundle(...) with a flashloan action. When the flashloan calls the callback of the Flasher, in _requestorExecution(...) of the BaseFlasher, it calls the function selector in the first 4 bytes in the requestorCalldata. However, in _bundleInternal(...), the correct selector is not enforced, so users can call any function of the BaseRouter. There does not seem to be any clear path for an exploit, but it's best to check. ### Recommendation Add if (bytes4(LibBytes.slice(requesterCalldata, 0, 4)) != this.xBundle(...).selector) revert(); or similar. ### Status Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, as indicated the severity of this issue is low. During Q3-2023 the team will be working on general optimizations/improvements on the router contracts. --- Related findings: - [The check rewardSelector != ZERO BYTES4 && rewardDestination.isContract() could be improved](https://0xsimao.com/findings/felix-reward-zero-bytes4-improved): Felix Price Feeds - [Attacker can trigger temporary shutdown due to RedStonePriceFeedBase missing gas check](https://0xsimao.com/findings/felix-temporary-shutdown-price-gas): Felix Price Feeds - [KeyringCoreV2Base::blacklistEntity() and KeyringCoreV2Base::unblacklistEntity() could check that the addresses are not already set](https://0xsimao.com/findings/keyring-ii-blacklist-entity-unblacklist-addresses): Keyring Credentials - [KeyringCoreV2Base::_createCredential() could use currentTime instead of block.timestamp on the creatBefore check](https://0xsimao.com/findings/keyring-ii-credential-current-timestamp-creat): Keyring Credentials