# Whitelisted functions aren't scoped to revenue contracts and may lead to unnoticed calls due to selector clashing

Spigot whitelists function selectors globally, not per revenue contract, so a 4-byte selector clash lets an operator call a malicious function the arbiter never approved.

- Payout: Contest reward
- Severity: medium
- Program: Debt DAO
- Credited: adriro
- Disclosed: 2023-02-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-debtdao-findings/issues/312
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-debtdao%3AM-07
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** SpigotLib / Spigot contract operate() whitelist
**Root cause:** Whitelisted function selectors are stored globally without association to a specific revenue contract, so a selector approved for one contract also enables any other contract function sharing that 4-byte selector.
**Steps:**
1. Arbiter reviews InnocentRevenueContract.collate_propagate_storage(bytes16) and calls `spigot.updateWhitelistedFunction(InnocentRevenueContract.collate_propagate_storage.selector, true)`
2. Attacker mines EvilRevenueContract.burn(uint256) whose selector equals collate_propagate_storage(bytes16)
3. `spigot.isWhitelisted(EvilRevenueContract.burn.selector)` now returns true
4. Operator calls `spigot.operate(address(evil), abi.encodeWithSelector(EvilRevenueContract.burn.selector, type(uint256).max))`
5. Malicious burn executes despite never being reviewed
**How found:** Reasoning about Solidity's 4-byte selector representation and the fact that whitelisting is keyed only on selector, not on (contract, selector); noted selector mining is cheap, analogous to known proxy function-clashing attacks.
**Exploitation:** Attacker deploys a revenue contract with a malicious function whose selector clashes with an innocuous whitelisted function; once the arbiter whitelists the innocent selector, the operator can invoke the malicious function through Spigot.operate on the attacker's contract.
**Insight:** When a whitelist/allowlist is keyed on a 4-byte selector alone, check whether it is scoped to the target address; if not, mine a clashing selector for a malicious function and get the benign one approved.