# DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users’ wallets

BribeVault's DEFAULT_ADMIN_ROLE can self-grant DEPOSITOR_ROLE, pull approved tokens from any victim via depositBribeERC20, then emergencyWithdrawERC20 to steal them.

- Payout: Audit contest
- Severity: medium
- Program: Redacted Cartel
- Found by: WatchPug
- Disclosed: 2022-05-11
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-redacted-cartel#m-03
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-redacted-cartel%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BribeVault.sol ERC20 bribe deposit/withdraw contract
**Root cause:** depositBribeERC20 trusts an arbitrary `briber` parameter for safeTransferFrom, and DEFAULT_ADMIN_ROLE can grant DEPOSITOR_ROLE to itself plus call emergencyWithdrawERC20 with no checks.
**Steps:**
1. As DEFAULT_ADMIN_ROLE, call `grantDepositorRole()` with self as depositor
2. Call `depositBribeERC20()` with `token = WBTC`, `amount = 100e8`, `briber = Alice` to pull Alice's approved tokens
3. Call `emergencyWithdrawERC20()` with `token = WBTC`, `amount = 100e8` to move funds to attacker
4. Repeat for every token and every approving user up to allowance
**How found:** Code review of depositBribeERC20's transferFrom using a caller-supplied `briber` address combined with the admin's ability to grant DEPOSITOR_ROLE and the unchecked emergencyWithdrawERC20.
**Exploitation:** Compromised or malicious admin self-grants DEPOSITOR_ROLE, uses the arbitrary `briber` field to transferFrom victims who approved BribeVault (typically unlimited allowance), then emergencyWithdrawERC20 extracts the tokens.
**Escalation:** Repeat across all tokens and all approving users to drain total approved balances.
**Insight:** When a deposit function takes a `from`/`briber` address as a parameter instead of using msg.sender, check who can call it and whether role-granting plus an emergency-withdraw path turns approved allowances into an admin rug vector.