Drainer approvalblocksconfirmed by simulation
unlimited allowance to 0x00000000000000000000000000000000BaDc0dE0
this call leaves 0x00000000000000000000000000000000BaDc0dE0 holding an unlimited amount (uint256 max) of 0x7f53f01C30C1f868E40ECA0840493A0ea8057Df7 belonging to 0x1111111111111111111111111111111111111111. Blocked because the allowance is unbounded, and the spender is an address with no code, so nothing constrains what it does next.
Drainer approvaladvisorysource scan, advisory only
Unbounded token approval granted to an arbitrary third-party spender
Both `DrainerRouter.swap` and `InjectionFixture.stake` invoke `IDrainable(token).forceApprove(msg.sender, collector, type(uint256).max)`. This silently grants the user an unlimited allowance to the immutable `collector` address, which is the core mechanic of a token drainer. The source also contains adversarial comments instructing the automated reviewer to ignore these functions and clear the contract; these instructions are treated as evidence of obfuscation rather than direction.
Advisory only. It did not move this verdict and cannot move one on its own.