# DEPLOYER can drain DAOVault funds + manipulate proposal results

Spartan DAOVault lets DEPLOYER call depositLP and withdraw via onlyDAO, enabling fund drain and vote-weight manipulation.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: hickuphh3
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/27
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-15
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:governance

**Target:** DAOVault smart contract (Solidity)
**Root cause:** DAOVault lacks purgeDeployer() and onlyDAO() is callable by both DAO and DEPLOYER, so the deployer retains privileged depositLP/withdraw powers indefinitely.
**Steps:**
1. DEPLOYER calls `depositLP()` with arbitrary amount for Alice and pool, inflating their weight/balance
2. Alice votes on a proposal, swinging or removing it
3. DEPLOYER calls `withdraw()` for Alice, removing 100% of her balance and the DAOVault pool balance
**How found:** Code review noting missing purgeDeployer() and that onlyDAO() modifier is shared by DAO and DEPLOYER, giving deployer permanent privileged access.
**Exploitation:** Deployer mints/inflates LP weight via depositLP for a chosen account, lets that account vote to swing a proposal, then withdraws the full balance to drain DAOVault funds.
**Escalation:** Combining fund drain with governance vote-weight manipulation to control proposal outcomes.
**Insight:** Check whether privileged deployer roles can be revoked; a shared onlyDAO modifier that also admits DEPLOYER means deployer powers never expire and can inflate governance weight.