# Automation / management can be set for not yet existing vault

Zero-address vault owner and proxy both return address(0), letting attackers pre-set automation/management fees on uninitialized vault IDs, draining funds once created.

- Payout: Contest reward
- Severity: high
- Program: Mimo DeFi
- Credited: Lambda
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-08-mimo-findings/issues/68
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-mimo%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MIMOAutoAction/MIMOManagedAction setAutomation on vault registry
**Root cause:** vaultOwner(vaultId) and proxyRegistry.getCurrentProxy(msg.sender) both return address(0) for uninitialized vault/caller, so the access check vaultOwner == mimoProxy passes trivially.
**Steps:**
1. Call `MIMOAutoAction.setAutomation(vaultId, ...)` from an address with no deployed proxy, using a vaultId that does not yet exist.
2. Both `vaultOwner(vaultId)` and `getCurrentProxy(msg.sender)` return `address(0)`, so the equality check passes.
3. Set very high automation fees in the parameters.
4. When the victim later creates that vault, it is already automated with attacker-chosen fees; attacker triggers actions to extract fees.
5. Same flow applies to `MIMOManagedAction.setManagement`.
**How found:** Observed that registry getters return address(0) for missing entries and that the access check compares two such getters, so both sides default to zero and the check passes.
**Exploitation:** Attacker pre-configures automation/management with high fees on a not-yet-existing vault ID; once the vault is created it inherits the malicious config, and attacker-performed actions siphon fees from the user.
**Insight:** When access control compares two registry lookups, test the uninitialized case: two address(0) defaults can satisfy an equality check, letting you write config for IDs that don't exist yet.