# Fund loss or theft by attacker with creating a flash loan and setting SuperVault as receiver so executeOperation() will be get called by lendingPool but with attackers specified params

SuperVault's Aave executeOperation() lacks initiator check, letting anyone trigger REBALANCE/LEVERAGE with attacker params and manipulated swap prices to drain vault funds.

- Payout: Audit contest
- Severity: high
- Program: Mimo DeFi
- Credited: unforgiven
- Disclosed: 2022-07-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-mimo-findings/issues/123
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-mimo%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** SuperVault Aave flash-loan callback executeOperation()
**Root cause:** executeOperation() only checks msg.sender == lendingPool, not that the flash loan was initiated by the vault itself, so any attacker can supply arbitrary params and dexTxData.
**Steps:**
1. Call Aave lendingPool.flashLoan() with SuperVault as receiver and crafted params encoding Operation.REBALANCE/LEVERAGE plus malicious dexTxData.
2. lendingPool calls SuperVault.executeOperation(); msg.sender check passes.
3. executeOperation decodes params and calls rebalanceOperation/leverageOperation, which call aggregatorSwap() with attacker-controlled dexTxData.
4. aggregatorSwap approves proxy and router.call(dexTxData), executing a bad-price swap against a pool the attacker manipulated.
5. Attacker reverses price manipulation, repays flash loan, and keeps vault funds; repeat to drain.
**How found:** Read Aave docs noting receiver is caller-specified, then code-read executeOperation() and saw only a msg.sender==lendingPool check with no initiator/self-initiation guard, and traced params into aggregatorSwap's arbitrary router.call.
**Exploitation:** Attacker flash-borrows to manipulate a DEX pool price, then triggers SuperVault.executeOperation() via Aave with crafted params causing aggregatorSwap to trade at the manipulated price, then unwinds the manipulation and repays the loan, extracting vault value.
**Escalation:** Repeatable griefing/theft loop drains user vault funds over multiple iterations.
**Insight:** For any contract implementing a lending-pool callback (Aave executeOperation, Uniswap flash callbacks), verify the loan was self-initiated via a transient flag or initiator==address(this); msg.sender==pool alone is insufficient because anyone can name you as receiver.