Attacker can abuse swapLiquidity function to drain users' funds
The `swapLiquidity` function allows liquidity providers to atomically swap their collateral. The function takes a receiverAddressargument that normally points to an `ISwapAdapter` implementation trusted by the user.\\n```\\nvars.fromReserveAToken.burn(\\n msg.sender,\\n receiverAddress,\\n amountToSwap,\\n fromReserve.liquidityIndex\\n);\\n// Notifies the receiver to proceed, sending as param the underlying already transferred\\nISwapAdapter(receiverAddress).executeOperation(\\n fromAsset,\\n toAsset,\\n amountToSwap,\\n address(this),\\n params\\n);\\n\\nvars.amountToReceive = IERC20(toAsset).balanceOf(receiverAddress);\\nif (vars.amountToReceive != 0) {\\n IERC20(toAsset).transferFrom(\\n receiverAddress,\\n address(vars.toReserveAToken),\\n vars.amountToReceive\\n );\\n\\n if (vars.toReserveAToken.balanceOf(msg.sender) == 0) {\\n \\_usersConfig[msg.sender].setUsingAsCollateral(toReserve.id, true);\\n }\\n\\n vars.toReserveAToken.mint(msg.sender, vars.amountToReceive, toReserve.liquidityIndex);\\n```\\n\\nHowever, since an attacker can pass any address as the `receiverAddress`, they can arbitrarily transfer funds from other contracts that have given allowances to the `LendingPool` contract (for example, another ISwapAdapter).\\nThe `amountToSwap` is defined by the caller and can be very small. The attacker gets the difference between `IERC20(toAsset).balanceOf(receiverAddress)` value of `toAsset` and the `amountToSwap` of `fromToken`.\\nRemediation\\nEnsure that no funds can be stolen from contracts that have granted allowances to the `LendingPool` contract.
Resolution\\nSolved by removing `swapLiquidity` functionality.
```\\nvars.fromReserveAToken.burn(\\n msg.sender,\\n receiverAddress,\\n amountToSwap,\\n fromReserve.liquidityIndex\\n);\\n// Notifies the receiver to proceed, sending as param the underlying already transferred\\nISwapAdapter(receiverAddress).executeOperation(\\n fromAsset,\\n toAsset,\\n amountToSwap,\\n address(this),\\n params\\n);\\n\\nvars.amountToReceive = IERC20(toAsset).balanceOf(receiverAddress);\\nif (vars.amountToReceive != 0) {\\n IERC20(toAsset).transferFrom(\\n receiverAddress,\\n address(vars.toReserveAToken),\\n vars.amountToReceive\\n );\\n\\n if (vars.toReserveAToken.balanceOf(msg.sender) == 0) {\\n \\_usersConfig[msg.sender].setUsingAsCollateral(toReserve.id, true);\\n }\\n\\n vars.toReserveAToken.mint(msg.sender, vars.amountToReceive, toReserve.liquidityIndex);\\n```\\n