# VaderPoolV2 owner can steal all user assets which are approved VaderPoolV2

VaderPoolV2 owner can call setTokenSupport to pull any user's approved USDV/foreignAsset tokens and mint LP NFT to themselves, stealing all approved assets.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/72
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VaderPoolV2 DEX pool contract (setTokenSupport)
**Root cause:** setTokenSupport lets the owner specify an arbitrary address to source initial liquidity from and an arbitrary LP NFT recipient, pulling tokens via existing ERC20 approvals without user consent.
**Steps:**
1. User grants ERC20 approval to VaderPoolV2 for USDV and foreignAsset.
2. Owner calls `setTokenSupport(...)` specifying the victim's address as liquidity source and owner as LP NFT recipient.
3. Contract pulls victim's approved USDV/foreignAsset via transferFrom and mints LP NFT to owner.
**How found:** Code review of setTokenSupport noticing it accepts arbitrary source address and LP recipient, combined with existing ERC20 approvals on the pool.
**Exploitation:** Owner/governance (Council) forces a proposal through the timelock to call setTokenSupport with victim addresses, draining all approved balances and receiving LP NFTs.
**Escalation:** Single Council entity can force proposal, only timelock delays theft; scales to all users with approvals.
**Insight:** Audit any owner-only function that takes a 'from' address and pulls funds via transferFrom: existing user approvals to the contract become an attack surface for privileged drain.