# onlyOwnerOrAssetManager can swap Yield Source in SwappableYieldSource at any time, immediately rugging all funds from old yield source

SwappableYieldSource.swapYieldSource lets owner/assetManager point to any contract implementing depositToken(), instantly draining all funds from the old yield source.

- Payout: Audit contest
- Severity: high
- Program: PoolTogether
- Found by: GalloDaSballo
- Disclosed: 2021-09-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-pooltogether-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-pooltogether%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:access-control

**Target:** SwappableYieldSource.sol swapYieldSource (Solidity contract)
**Root cause:** swapYieldSource is callable by owner or assetManager and accepts any address whose contract implements depositToken() external returns (address), with no trusted-registry or timelock check, so a malicious yield source can be substituted at will.
**Steps:**
1. Be the Owner or AssetManager of SwappableYieldSource.
2. Deploy a malicious contract implementing `function depositToken() external returns (address)`.
3. Call `setYieldSource`/`swapYieldSource` pointing at the malicious contract.
4. All funds are pulled from the old yield source and transferred to the attacker-controlled one.
**How found:** Code review of swapYieldSource access control and its only check on the new yield source (the depositToken() interface), noting no registry/timelock constraint on a privileged, fund-moving operation.
**Exploitation:** A privileged owner or assetManager swaps the yield source to an attacker-controlled contract that satisfies the depositToken() interface; the swap moves all funds from the old yield source into the malicious one, letting the attacker take them.
**Insight:** For privileged fund-moving setters, check not just who can call but what the new target must satisfy: an interface-only check (single function signature) is trivially spoofable, so require a trusted registry or timelock.