# IndexLogic: An attacker can mint tokens for himself using assets deposited by other users

IndexLogic.mint credits tokens without pulling the caller's assets, so anyone can mint against another user's pre-deposited vToken balance.

- Payout: Audit contest
- Severity: high
- Program: Phuture Finance
- Credited: cccz
- Disclosed: 2022-02-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-phuture-findings/issues/19
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** IndexLogic.mint in Phuture index contracts
**Root cause:** mint assumes assets were already transferred to vToken and never calls transferFrom, so it mints based on the contract's existing balance rather than the caller's payment.
**Steps:**
1. Victim transfers assets to vToken in advance, then calls mint (per intended flow).
2. Attacker monitors vToken asset balance; when balance > lastBalance, attacker calls `mint` on IndexLogic.
3. mint computes shares from the inflated balance and credits the attacker without pulling any of the attacker's funds.
**How found:** Code reading of IndexLogic.mint revealed it never performs transferFrom, relying on a prior external transfer; the balance-based accounting implies any caller can mint against others' deposits.
**Exploitation:** Attacker watches vToken balance for deposits from other users and front-runs/back-runs with a direct mint call, receiving index tokens backed by victims' assets, then redeems to extract value.
**Insight:** When a mint/deposit function reads pool balance instead of pulling funds itself, check whether an unrelated caller can mint against another user's pending transfer; balance-delta accounting without transferFrom is a classic theft primitive.