# Stealing Wrapped Manifest in WETH.sol

WETH.sol exposed approve(owner,spender) letting anyone set allowance over any holder's tokens, then transferFrom to steal all wrapped Manifest.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Credited: Soosh
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/19
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** WETH.sol ERC20 wrapper contract
**Root cause:** An extra approve(address owner, address spender) function sets allowance for an arbitrary owner instead of msg.sender, so any caller can grant themselves allowance over any holder's balance.
**Steps:**
1. Call `approve(victim, attacker)` on WETH.sol — sets allowance[victim][attacker] to an arbitrary value
2. Call `transferFrom(victim, attacker, wad)` to move victim's wrapped Manifest to attacker
3. Call withdraw to convert Wrapped Manifest back to Manifest
**How found:** Code review of WETH.sol approve overloads; noticed an approve variant taking owner as a parameter rather than using msg.sender.
**Exploitation:** Attacker approves themselves as spender for any victim's balance via the owner-parameterized approve, then pulls funds with transferFrom and unwraps to native Manifest. No capital or preconditions beyond a victim holding wrapped tokens.
**Insight:** On ERC20 wrappers, enumerate every approve/allowance overload — a stray owner-parameterized approve is an instant drain primitive; compare against the canonical two-arg approve using msg.sender.