# Wrong design/implementation of permission control allows malicious/compromised Registry or Factory admin to steal funds from users' wallet balances

Vault's onlyMarket check trusts Registry listing, so a Registry/Factory admin can register an arbitrary market and pull any user's approved tokens via addValue then withdrawAllAttribution.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: WatchPug
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/266
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-07
- Tags: domain:web3 impact:funds-loss impact:privesc kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity Vault/Registry/Factory contracts
**Root cause:** Vault#addValue is gated only by IRegistry.isListed(msg.sender) and accepts arbitrary _from and _beneficiary, so anyone who can register a market can spend any user's ERC20 allowance to the Vault and credit attributions to themselves.
**Steps:**
1. Registry owner calls `Registry#supportMarket(attackerAddress)` to set `markets[attackerAddress]=true` (or Factory owner calls `createMarket()` with a malicious template).
2. Attacker contract calls `Vault#addValue(token.balanceOf(victim), victim, attacker)`; safeTransferFrom pulls victim's approved tokens into the Vault and credits `attributions[attacker]`.
3. Attacker calls `Vault#withdrawAllAttribution(attacker)` to withdraw the funds.
4. Repeat for every user with an allowance to each Vault.
**How found:** Code review of Vault's onlyMarket modifier and addValue signature: noticed addValue takes arbitrary _from/_beneficiary and only checks registry listing, then traced Registry#supportMarket and Factory#createMarket to see who can add a market.
**Exploitation:** Compromised or malicious Registry/Factory owner key registers an attacker-controlled market, then uses the Vault's blanket allowance to transferFrom victims' balances into the Vault credited to the attacker, and immediately withdraws via withdrawAllAttribution, draining all approved token balances across Vaults.
**Escalation:** Repeat across all users who approved each Vault and across all Vault contracts to drain aggregate approved balances.
**Insight:** When a contract holds user ERC20 allowances, audit every function that calls safeTransferFrom: if the spender set is controlled by an admin/registry rather than the allowance owner, admin compromise equals draining all approvals.