# Reaper Farm: missing access control in vault redeem drains user funds

Reaper Farm vault lacked access control on redeem, letting attacker redeem victim's shares to themselves and steal ~$1.7M USDC.

- Payout: Real-world hack
- Severity: critical
- Program: Reaper Farm
- Analysis by: DeFiHackLabs
- Disclosed: 2022-08-01
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-08/ReaperFarm_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220801-reaperfarm
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** ReaperVaultV2 (rfUSDC) on Fantom
**Root cause:** The redeem function did not verify that the caller was authorized to spend the owner's shares, allowing anyone to redeem on behalf of any address.
**Steps:**
1. Identify victim address with a large ReaperVault balance.
2. Call `ReaperVault.redeem(victim_bal, address(this), victim)` where victim_bal is the victim's share balance.
3. Receive the redeemed USDC in the attacker's contract.
**Exploitation:** Attacker called redeem with the victim's address as owner and their own address as receiver, converting the victim's vault shares into USDC sent directly to the attacker.
**Insight:** Vault share redemption functions must enforce that msg.sender is either the owner or an approved spender; test redeem/withdraw with arbitrary owner addresses.