# Malicious pools can be deployed through BathHouse

Reentrancy via ERC20 approve callback during BathToken.initialize lets a malicious token become a pool's underlying, granting attacker infinite approval over LPs' deposits.

- Payout: Contest reward
- Severity: medium
- Program: Rubicon
- Credited: Bahurum
- Disclosed: 2022-08-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-05-rubicon-findings/issues/326
- Library page: https://bugbountylibrary.com/r/c4%3A2022-05-rubicon%3AM-26
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:reentrancy

**Target:** BathHouse.openBathTokenSpawnAndSignal / BathToken.initialize
**Root cause:** BathToken.initialize performs an external approve() call on the underlying token before setting initialized=true, so a malicious underlying token can reenter initialize and reassign bathHouse/underlying roles.
**Steps:**
1. Deploy fakeToken whose approve() reenters BathToken.initialize(trueToken, owner, owner) on first call (counterApprove==1)
2. Call `BathHouse.openBathTokenSpawnAndSignal()` with newBathTokenUnderlying = fakeToken address
3. During initialize's approve, fakeToken reenters and reassigns bathHouse role to itself and underlyingToken to the legit token, with attacker as market
4. fakeToken (now bathHouse) calls setMarket(realMarket) and approveMarket()
5. LPs deposit legit tokens into the pool; attacker calls emptyPool() to transferFrom pool balance to owner
**How found:** Code reading of BathToken.initialize: noticed the external approve() at L214 occurs before initialized is set, enabling reentrancy from a malicious underlying token.
**Exploitation:** Attacker deploys a malicious ERC20 that reenters BathToken.initialize during the approve call, hijacking the bathHouse role and setting the pool's underlying to a legitimate token while granting the attacker (as market) infinite approval; LPs deposit real tokens and attacker drains via transferFrom.
**Insight:** When a factory initializes a clone with an attacker-supplied ERC20, the token's approve/transfer hooks are attacker code; check ordering of external calls vs. initialization flags (CEI) in initialize functions.