# anyone can call function sponsor

Reality Cards' sponsor() lacked access control, letting anyone pull tokens from any address with a nonzero allowance to the contract.

- Payout: Audit contest
- Severity: high
- Program: Reality Cards
- Found by: paulius.eth
- Disclosed: 2021-08-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-realitycards-findings/issues/40
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-realitycards%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Solidity market contract sponsor() function
**Root cause:** sponsor() is intended to be called only by the Factory during market creation but has no caller authentication, so any external address can invoke it with an arbitrary _sponsorAddress.
**Steps:**
1. Identify a victim address with a nonzero ERC20 allowance to the market contract.
2. Call `sponsor(victimAddress, amount)` directly from an attacker-controlled address.
3. Contract executes `_sponsor(_sponsorAddress, _amount)`, pulling the victim's tokens via the existing allowance.
**How found:** Code review of sponsor(): the docstring says it is called by the Factory during market creation, but the function body has no msg.sender check, prompting the hypothesis that anyone could invoke it with an arbitrary sponsor address.
**Exploitation:** Attacker calls sponsor() with a victim's address as _sponsorAddress; the contract transfers the victim's tokens (up to their allowance) into the pot without the victim's consent.
**Insight:** When a function's docstring says 'called by Factory' or similar, verify the caller check actually exists in the body; missing auth on a function that pulls funds via allowance turns any outstanding approval into a theft primitive.