When the amout of token acquired by a flash loan exceeds the expected value, the callback function will fail.
When the amout of token acquired by a flash loan exceeds the expected value, the callback function will fail.\\nThe function `wagmiLeverageFlashCallback` is used to handle the repayment operation after flash loan. After obtaining enough saleToken, it uses `_v3SwapExact` to convert the saleToken into holdToken. We know that the amount of holdTokens (holdTokenAmtIn) is proportional to the amount of saleTokens (amountToPay) obtained from flash loans. Later, the function will check the `holdTokenAmtIn` is no large than decodedData.holdTokenDebt.\\n```\\n// Swap tokens to repay the flash loan\\nuint256 holdTokenAmtIn = _v3SwapExact(\\n    v3SwapExactParams({\\n        isExactInput: false,\\n        fee: decodedData.fee,\\n        tokenIn: decodedData.holdToken,\\n        tokenOut: decodedData.saleToken,\\n        amount: amountToPay\\n    })\\n);\\ndecodedData.holdTokenDebt -= decodedData.zeroForSaleToken\\n    ? decodedData.amounts.amount1\\n    : decodedData.amounts.amount0;\\n\\n// Check for strict route adherence, revert the transaction if conditions are not met\\n(decodedData.routes.strict && holdTokenAmtIn > decodedData.holdTokenDebt).revertError(\\n    ErrLib.ErrorCode.SWAP_AFTER_FLASH_LOAN_FAILED\\n);\\n```\\n\\nIn the function `_excuteCallback`, the amount of token finally obtained by the user through flash loan is `flashBalance`, which is the balance of the contract.\\n```\\n// Transfer the flashBalance to the recipient\\ndecodedData.saleToken.safeTransfer(decodedDataExt.recipient, flashBalance);\\n// Invoke the WagmiLeverage callback function with updated parameters\\nIWagmiLeverageFlashCallback(decodedDataExt.recipient).wagmiLeverageFlashCallback(\\n    flashBalance,\\n    interest,\\n    decodedDataExt.originData\\n);\\n```\\n\\nNow let me describe how the attacker compromises the flash loans.\\nFirst, the attacker makes a donation to the `FlashLoanAggregator` contract before the victim performs a flash loan (using front-run). Then victim performs a flash loan, and he/she will get much more flashBalance than expected. Finally, in the function `wagmiLeverageFlashCallback`, the holdTokenAmtIn is larger than experted, which leads to fail.
In the function `_excuteCallback`, the amount of token finally obtained by the user through flash loan should be the the balance difference during the flash loan period.
DOS
```\\n// Swap tokens to repay the flash loan\\nuint256 holdTokenAmtIn = _v3SwapExact(\\n    v3SwapExactParams({\\n        isExactInput: false,\\n        fee: decodedData.fee,\\n        tokenIn: decodedData.holdToken,\\n        tokenOut: decodedData.saleToken,\\n        amount: amountToPay\\n    })\\n);\\ndecodedData.holdTokenDebt -= decodedData.zeroForSaleToken\\n    ? decodedData.amounts.amount1\\n    : decodedData.amounts.amount0;\\n\\n// Check for strict route adherence, revert the transaction if conditions are not met\\n(decodedData.routes.strict && holdTokenAmtIn > decodedData.holdTokenDebt).revertError(\\n    ErrLib.ErrorCode.SWAP_AFTER_FLASH_LOAN_FAILED\\n);\\n```\\n