# Malicious Market Creators Can Steal Tokens From Unsuspecting Approved Reference Accounts

InsureDAO Factory.createMarket lets a malicious creator set _references[4] to any approved account, forcing a vault deposit from that victim's tokens.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: leastwood
- Disclosed: 2022-03-15
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/224
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Factory.createMarket / PoolTemplate.initialize vault deposit
**Root cause:** PoolTemplate.initialize calls _depositFrom(_conditions[1], _references[4]) where _references[4] is attacker-supplied and only checked against the reference allowlist, not tied to msg.sender; the deposit pulls from that address's Vault.sol allowance.
**Steps:**
1. Victim (approved reference) grants unlimited approval to Vault.sol
2. Attacker calls `Factory.createMarket(template, metaData, conditions, references)` with `_references[4]` = victim address and `_conditions[1] > 0`
3. Factory clones template and calls `market.initialize(...)`
4. PoolTemplate.initialize executes `_depositFrom(_conditions[1], _references[4])`, pulling victim tokens into attacker's market
**How found:** Manual code review of Factory.createMarket and PoolTemplate.initialize; noticed _references[4] is user-controlled and used as the deposit source in _depositFrom, combined with the reference allowlist check only validating membership, not ownership.
**Exploitation:** Attacker frontruns or races an honest market creator's createMarket tx, substituting _references[4] with the honest creator's address; the victim's pre-existing unlimited Vault.sol approval is drained into the attacker-controlled market, making funds unrecoverable and potentially exceeding intended deposit size.
**Insight:** When a factory passes user-supplied arrays into a template initializer, check every index that becomes a fund source or authority — allowlist membership is not ownership; look for deposit/transfer-from calls whose 'from' address is an array element rather than msg.sender.