# Tokens can be stolen through transferTo

Vader's transferTo() trusts tx.origin and skips approvals, so a malicious ERC20 hook can drain a victim's VADER/USDV/SYNTHS when they interact with it.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/217
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-16
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ERC20 transferTo() function on VADER/USDV/SYNTHS tokens
**Root cause:** transferTo() authorizes transfers based on tx.origin and skips allowance checks, so any contract the victim's EOA calls can move the victim's core tokens.
**Steps:**
1. Attacker deploys malicious ERC20 whose `_transfer` hook checks `tx.origin` and calls `transferTo` on VADER/USDV/SYNTHS to move victim funds to attacker.
2. Attacker seeds liquidity in `BASE <> ATTACKER` pool to give the token apparent value.
3. Attacker airdrops ATTACKER tokens to high-profile holders of VADER/USDV/SYNTHS.
4. Victim attempts to sell airdropped ATTACKER token via Vader swap; hook fires and drains all their VADER/USDV/SYNTHS.
**How found:** Read the docs' explicit claim that transferTo interrogates tx.origin and skips approvals, and reasoned that any external contract the user touches inherits that authority.
**Exploitation:** Honeypot token with a transfer hook abuses tx.origin-based transferTo to pull the victim's entire core-asset balance during an otherwise unrelated swap.
**Escalation:** Victim loses all core protocol tokens, not just the swapped token, since transferTo ignores approvals across VADER/USDV/SYNTHS.
**Insight:** When a token authorizes by tx.origin instead of msg.sender plus allowance, any contract a user interacts with can impersonate them; treat tx.origin auth as equivalent to unlimited approval to all callers.