# Missing checks allow strategists to steal all fund via tailOff

Strategist calls tailOff with arbitrary _stratUtil and underlying token as filledAssetToRebalance, draining all BathToken deposits to attacker contract.

- Payout: Contest reward
- Severity: medium
- Program: Rubicon
- Credited: shenwilly
- Disclosed: 2022-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-05-rubicon-findings/issues/211
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BathPair/BathToken strategy rebalance functions
**Root cause:** tailOff accepts an arbitrary _stratUtil address and rebalance permits the underlying token as filledAssetToRebalance, so a strategist can route the pool's underlying balance to any contract.
**Steps:**
1. Call `tailOff` on BathPair with `targetPool=bathUSDC`, `tokenToHandle=USDC`, `targetToken=USDT`, `_stratUtil=maliciousContract`, `amount=USDC.balanceOf(bathUSDC)`, `hurdle=0`, `_poolFee=0`
2. BathToken.rebalance transfers the full USDC balance to the attacker-controlled _stratUtil contract
**How found:** Code review of tailOff and rebalance revealed missing validation on _stratUtil and on filledAssetToRebalance allowing the underlying token.
**Exploitation:** A malicious strategist supplies their own contract as _stratUtil and the pool's underlying token as the asset to rebalance, causing BathToken to send its entire underlying balance to the attacker.
**Insight:** When a privileged role supplies both a target address and an asset to move, check whether the asset can equal the pool's own underlying and whether the target is attacker-controlled.