# Anyone can curate pools and steal rewards

Unrestricted Router.curatePool/replacePool let anyone swap curated pools and redirect rewards to an attacker-controlled token pool.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/210
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-23
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** Router.curatePool / replacePool on Vader Protocol
**Root cause:** Router.curatePool and replacePool lack access control, so any caller can replace existing curated pools with their own, and curated status gates reward distribution.
**Steps:**
1. Obtain base tokens (flash loan or own liquidity)
2. Call `Router.curatePool` to curate an attacker-controlled pool with a custom token
3. Call `Router.replacePool` to remove an existing curated pool and substitute the attacker's pool
4. Swap repeatedly in the attacker's pool with useless custom tokens to accrue rewards
5. Withdraw liquidity and repay the flash loan
**How found:** Noticed curatePool/replacePool had no access restriction and that curated status controls reward eligibility, then reasoned a flash loan could fund the replacement.
**Exploitation:** Attacker flash-loans base tokens, replaces a legitimate curated pool via replacePool, adds their own pool with a custom token they control, then games reward accrual by swapping in that pool, withdraws liquidity, and repays the loan.
**Insight:** When a function gates reward eligibility, check whether pool/registry membership can be replaced by any caller; even without flash loans, temporarily providing liquidity (no swap, no slip fee) can satisfy preconditions.