# Anyone Can Arbitrarily Mint Synthetic Assets In VaderPoolV2.mintSynth()

mintSynth() accepts an arbitrary `from` and `to`, letting an attacker frontrun a victim's approval to mint synths to themselves and drain the victim's deposit.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/146
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-13
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** VaderPoolV2.mintSynth() DEX pool contract
**Root cause:** mintSynth() takes user-supplied `from` and `to` arguments and calls safeTransferFrom(from, ...) without binding `from` to msg.sender, so anyone can spend another user's approval and direct the minted synth to themselves.
**Steps:**
1. Victim approves VaderPoolV2 as spender for nativeDeposit.
2. Attacker monitors mempool/chain for approvals matching VaderPoolV2.
3. Attacker calls `mintSynth(foreignAsset, nativeDeposit, to=attacker)` with `from=victim`.
4. safeTransferFrom pulls nativeDeposit from victim; synth is minted and transferred to attacker's `to` address.
**How found:** Manual code review of mintSynth() noticing the function is externally callable and takes `from`/`to` parameters rather than using msg.sender, combined with the standard ERC20 approval model enabling frontrunning of pending approvals.
**Exploitation:** Attacker frontruns the victim's mintSynth call by submitting their own mintSynth with `from` set to the victim and `to` set to the attacker, consuming the victim's approval and receiving the freshly minted synthetic asset while the victim pays the deposit.
**Insight:** On any pool/AMM-style contract, check whether transfer helpers use a caller-supplied `from` instead of msg.sender; any function taking `from` plus an approval-based pull is frontrunnable against pending approvals.