# Attacker can drain all the projects within minutes, if admin account has been exposed

Compromised admin signing one tx can swap the trusted forwarder, then impersonate all users via approveHash to drain every project.

- Payout: Contest reward
- Severity: medium
- Program: Rigor Protocol
- Credited: 0xA5DF
- Disclosed: 2022-09-12
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-08-rigor-findings/issues/264
- Library page: https://bugbountylibrary.com/r/c4%3A2022-08-rigor%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:auth-bypass

**Target:** HomeFi.sol trusted forwarder / EIP-2771 meta-tx handling
**Root cause:** setTrustedForwarder is a single-step admin call, and approveHash uses _msgSender() so a malicious forwarder can impersonate contractor/subcontractor/builder to approve arbitrary hashes.
**Steps:**
1. Admin signs one tx (meta or normal) calling `setTrustedForwarder(maliciousForwarder)`
2. Malicious forwarder executes `replaceAdmin(attacker)` via meta-tx, locking out admin
3. Forwarder calls `approveHash(hash)` as contractor, subcontractor, builder for a crafted task completion payload
4. Call `project.setComplete(encodedData, "0x")` to mark task complete and trigger fund transfers
**How found:** Code review of HomeFi admin functions and EIP-2771 _msgSender() usage; noticed forwarder has unrestricted power and approveHash trusts _msgSender(), enabling impersonation once forwarder is swapped.
**Exploitation:** Attacker who controls admin signing (hacked host, malicious site, tampered meta-tx data) submits a single setTrustedForwarder tx to a malicious forwarder contract. The forwarder then impersonates admin to replaceAdmin, and impersonates project participants via approveHash to force setComplete, moving task cost funds to attacker-controlled subcontractor.
**Escalation:** Forwarder control grants full system authority: replace admin, change subcontractor, add/modify tasks and costs, drain all projects within minutes.
**Insight:** When a contract uses EIP-2771 _msgSender(), any function gated on _msgSender() (like approveHash) is fully controllable by the trusted forwarder; audit single-step admin setters that swap the forwarder as a full-takeover primitive.