# Anyone Can Arbitrarily Mint Fungible Tokens In VaderPoolV2.mintFungible()

VaderPoolV2.mintFungible() lacked access control and trusted a caller-supplied `from` address, letting an attacker frontrun a victim's approval to mint LP tokens to themselves.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/147
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-14
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** VaderPoolV2.mintFungible() DEX pool contract
**Root cause:** mintFungible() was externally callable without an onlyRouter modifier and pulled deposits via safeTransferFrom using a caller-supplied `from` argument instead of msg.sender.
**Steps:**
1. Victim approves VaderPoolV2 as spender for native/foreign tokens.
2. Attacker monitors mempool for the victim's mintFungible() call.
3. Attacker frontruns with `mintFungible(..., from=victim, to=attacker, nativeDeposit, foreignDeposit)`.
4. safeTransferFrom pulls victim's approved tokens; LP tokens minted and transferred to attacker's `to` address.
**How found:** Manual code review of mintFungible() revealed the missing onlyRouter modifier and the caller-controlled `from` parameter; dev initially disputed (pool not meant for direct interaction) but judge noted enforcement was needed, and dev confirmed the missing modifier.
**Exploitation:** Attacker watches for approvals to VaderPoolV2, then calls mintFungible() with from set to the victim and to set to their own address, causing the victim's approved deposits to be pulled and LP tokens minted to the attacker.
**Insight:** When a pool/router contract exposes mint/deposit functions, check whether they are gated by an onlyRouter modifier and whether the `from` address is caller-supplied rather than msg.sender — a missing modifier plus a user-controlled `from` enables approval-frontrun theft.