# A malicious/compromised Registry or Factory admin can drain all the funds from the Vault contracts

Registry/Factory admin can register a malicious market that calls Vault.borrowValue to transfer all vault tokens to an arbitrary address.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: WatchPug
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/272
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Solidity Vault/Registry contracts
**Root cause:** Vault.borrowValue trusts any address listed in Registry.isListed and transfers tokens to an arbitrary _to with no cap or timelock on market registration.
**Steps:**
1. Registry admin (or compromised key) calls supportMarket with attacker-controlled market contract
2. Attacker market calls `Vault.borrowValue(amount, attackerAddress)`
3. onlyMarket passes because isListed(market)==true
4. Vault transfers full token balance to attacker
**How found:** Code review of the onlyMarket modifier and borrowValue: noticed isListed is the sole gate and borrowValue has no upper bound, so any listed market can move arbitrary amounts to any address.
**Exploitation:** Compromise or malicious Registry/Factory admin registers a market contract, then invokes borrowValue to sweep vault tokens to an arbitrary address; no timelock or per-pool cap limits the drain.
**Insight:** When an access-control modifier delegates trust to a registry, audit who can write to that registry and whether registration is timelocked/capped; privileged registration plus unbounded transfer equals rug vector.