# Splitter: Anyone can call incrementWindow to steal the tokens in the contract

Splitter.incrementWindow trusts caller-supplied RoyaltyVault interface, letting anyone inflate balanceForWindow and drain contract via claim.

- Payout: Audit contest
- Severity: high
- Program: Joyn
- Found by: cccz
- Disclosed: 2022-07-25
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-03-joyn-findings/issues/3
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-joyn%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Splitter.sol incrementWindow / claim
**Root cause:** incrementWindow authenticates msg.sender only via IRoyaltyVault interface calls (supportsInterface, getSplitter) that an attacker-controlled fake contract can satisfy, with no allowlist of real vault addresses.
**Steps:**
1. Deploy fake contract implementing supportsInterface(IID_IROYALTY)=>true and getSplitter()=>Splitter address
2. Ensure Splitter holds tokens (wethBalance >= royaltyAmount)
3. Call `Splitter.incrementWindow(royaltyAmount)` from fake contract, pushing royaltyAmount into balanceForWindow and incrementing currentWindow
4. As a verified user call `claim` or `claimForAllWindows` to withdraw the inflated amount, draining contract balance
**How found:** Code reading: noticed incrementWindow is meant to be called only on token transfer but its only auth is interface checks on msg.sender, which any contract can fake.
**Exploitation:** Attacker deploys a fake RoyaltyVault satisfying the two require checks, calls incrementWindow to inflate balanceForWindow beyond actual balance, then claims the inflated window amount to steal tokens held by the Splitter.
**Insight:** When access control relies on calling interface methods on msg.sender (supportsInterface/getX), any attacker contract can return the expected values; look for missing allowlists/registry checks on caller identity in payout-accounting functions.