# Malicious Users Can Exploit Residual Allowance To Steal Assets

BaseVault batchDeposit functions pull tokens from an arbitrary _from address, letting anyone spend a victim's residual approval to steal their ERC20/721/1155 assets.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: xiaoming90
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/468
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BaseVault protoform deposit functions (batchDepositERC20/721/1155)
**Root cause:** The batchDeposit functions accept an arbitrary _from parameter and call transferFrom(_from, _to, ...) instead of pulling from msg.sender, so any caller can move tokens for which the vault holds an approval.
**Steps:**
1. Victim approves BaseVault: `erc20.approve(baseVault, type(uint256).max)`, `erc721.setApprovalForAll(baseVault, true)`, `erc1155.setApprovalForAll(baseVault, true)`
2. Victim deposits a partial amount via `baseVault.batchDepositERC20(alice, vault, [XYZ], [50])`, leaving residual allowance
3. Attacker calls `baseVault.batchDepositERC20(alice, attacker, [XYZ], [950])`
4. Attacker calls `baseVault.batchDepositERC721(alice, attacker, [APE,APE], [#2,#3])` and `batchDepositERC1155(alice, attacker, [ABC], [#1], [950], "")`
5. Tokens transfer from victim to attacker using the victim's approval
**How found:** Code review of the deposit protoform: noticed the _from parameter is caller-supplied and used directly in transferFrom, meaning the contract acts on any approved holder's balance rather than the caller's.
**Exploitation:** Attacker needs only to observe a victim's outstanding approval to BaseVault (common since max approvals are typical), then calls the public batchDeposit functions with _from=victim and _to=attacker to transfer remaining ERC20/721/1155 balances directly to themselves.
**Insight:** When a helper/aggregator contract holds broad token approvals, check whether transfer functions take a user-supplied 'from' instead of msg.sender — any approved holder's residual allowance becomes stealable by anyone.