# In BaseRouter, _handleSwapAction(...), users shouldn't be allowed to send funds to an allowed flasher Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-L03 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description _handleSwapAction(...) allows sending funds to the Flasher. This should be to pay for a taken flashloan. However, if the goal of this exception is only to enable the payment of a flashloan, it should be removed and handled differently. This is because it may allow users to send funds to the flasher, without taking a flashloan, either maliciously or by mistake. ### Recommendation Create a new action called repayFlashLoan and use it to repay the flashLoan. This action should revert if the amount being repaid is bigger than the flashloan taken. ### Status Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, as indicated the severity of this issue is low. During Q3-2023 we will be working on general optimizations/improvements on the router contracts. --- Related findings: - [KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()](https://0xsimao.com/findings/keyring-ii-keyring-fees-send-transfer): Keyring Credentials - [`_sendOrEscrowFunds` will brick LCG funds causing insolvency](https://0xsimao.com/findings/teller-finance-escrow-lcg-causing-insolvency): Teller Finance - [FlashSwapRouter::emptyReserve() and FlashSwapROuter::emptyReservePartial() functions return incorrect values](https://0xsimao.com/findings/cork-protocol-flash-empty-outer-partial): Cork Protocol - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor): Cork Protocol