# Anyone can list anchors / curate tokens

Anyone could call Router.listAnchor/replaceAnchor to curate pools, since addLiquidity auto-marks any token as anchor, letting attackers steal reward allocation and manipulate anchor prices.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/211
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** Router.listAnchor / replaceAnchor and Pools.addLiquidity on Vader Protocol
**Root cause:** Pools.addLiquidity unconditionally sets _isAnchor[token]=true, so the isAnchor check in listAnchor is trivially satisfiable; listAnchor/replaceAnchor have no access control and bounds checks use spot reserves.
**Steps:**
1. Call `Pools.addLiquidity(VADER, token, _)` once (no tokens actually needed) to set `_isAnchor[token]=true`.
2. Call `Router.listAnchor(token)` while `anchorLimit` not reached to anchor an arbitrary token.
3. Once limit reached, use `replaceAnchor` with flash-loan-inflated liquidity to push another anchor out of price range.
4. Withdraw flash-loaned liquidity, leaving the anchor price manipulable next block.
**How found:** Code review of listAnchor's only guard `require(iPOOLS(POOLS).isAnchor(token))` and tracing that addLiquidity sets `_isAnchor[token]=true` without further checks, making the guard meaningless.
**Exploitation:** Attacker anchors a custom token they control, redirecting curated-pool rewards to their own pool and removing rewards from a legitimate curated pool; flash loans bypass liquidity bounds in replaceAnchor, and post-anchor withdrawal leaves anchor price easy to manipulate for follow-on attacks.
**Escalation:** Chaining flash-loan liquidity to satisfy reserve-based bounds, then withdrawing to leave manipulable anchor price for subsequent attacks.
**Insight:** When an access-control check delegates to a state flag, trace every writer of that flag; a permissionless function that sets it (even with zero-value args) nullifies the guard. Also check whether bounds use spot reserves, which flash loans can satisfy.