# Sovryn Loan Vulnerability Bugfix Review

Sovryn's borrow() and marginTrade() failed to check msg.sender against borrower, letting anyone open a loan against another user's collateral and redirect proceeds to themselves.

- Payout: $76,568
- Severity: critical
- Program: Sovryn
- Credited: Turbo
- Disclosed: 2021-05-11
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/sovryn-loan-vulnerability-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sovryn-loan-vulnerability-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LoanTokenLogicStandard.sol borrow() and marginTrade() on RSK
**Root cause:** borrow() and marginTrade() validated that loanId matched a borrower but never checked msg.sender == borrower, and allowed an arbitrary receiver address for loan proceeds.
**Steps:**
1. Identify a loanId with unused collateral and its borrower address
2. Call `borrow(loanId, borrower, receiver=attacker, ...)` with valid loan params but attacker's address as receiver
3. Attacker receives loan proceeds backed by victim's collateral; no repayment obligation falls on attacker
4. Repeat via `marginTrade()` to force a victim into an unfavorable margin position
**Exploitation:** Attacker enumerates loanIds with unused collateral, calls borrow() with the matching borrower but their own receiver address, drawing a loan against the victim's collateral and keeping the proceeds with no penalty for default.
**Escalation:** Same missing-caller-check pattern in marginTrade() let attacker force a victim into an unfavorable margin position, though no funds were stolen there.
**Insight:** In lending contracts, check every privileged parameter (borrower, trader, receiver) against msg.sender, not just that the loanId maps to a valid borrower; a receiver parameter that accepts arbitrary addresses is a red flag for collateral theft.