# A vault owner can frontrun a plugin call and change its implementation

Vault owner can overwrite an installed plugin's selector mapping at any time, frontrunning a user's call to swap in malicious implementation logic.

- Payout: Contest reward
- Severity: medium
- Program: Fractional
- Credited: 0xNineDec
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/267
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-02
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:business-logic

**Target:** Vault plugin registry (methods selector mapping)
**Root cause:** Vault.install() writes to the methods mapping without checking whether the selector is already registered, so a vault owner can silently repoint an existing selector to a new implementation.
**Steps:**
1. Deploy vault via `VaultRegistry.createFor()` with a legit plugin at selector `S` pointing to address A.
2. Victim submits a tx calling selector `S` expecting implementation A.
3. Owner frontruns with `IVault(vault).install([S],[maliciousAddr])` to repoint `S`.
4. Victim's tx executes against malicious implementation.
5. Owner optionally backruns to restore `S` to A.
**How found:** Code review of Vault.install() and the methods mapping: noticed no check that a selector is unset before writing, and that createFor() lets the deployer freely manage plugins, enabling overwrite/frontrun.
**Exploitation:** Malicious vault owner watches mempool for a call to a known plugin selector, frontruns with install() using the same selector to swap in a malicious plugin, causing the victim's call to execute unintended logic; can backrun to restore the legit plugin and hide the swap.
**Insight:** When a contract exposes an owner-controlled selector->implementation mapping, check whether install/upgrade paths reject already-registered selectors; an unchecked overwrite turns any pending user call into a frontrunnable target.