# Vault can be created for not-yet-existing ERC20 tokens, which allows attackers to set traps to steal NFTs from Borrowers

Solmate SafeTransferLib doesn't verify token code, so vaults can be created for not-yet-deployed token addresses, letting attackers pre-trap future tokens and steal depositors' funds.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: pwnforce
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/158
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-25
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AstariaRouter/Vault/PublicVault/ClearingHouse/TransferProxy/WithdrawProxy ERC20 transfer paths
**Root cause:** Solmate SafeTransferLib's safeTransfer/safeTransferFrom never check that the token address has code, so calls to a codeless address silently succeed and the protocol records a transfer that never happened.
**Steps:**
1. Attacker deploys a PublicVault for a token address that has no code yet on this chain (e.g. 10000e18 TokenA/TokenB/TokenC).
2. Later a project deploys its real token at that same address (same deployer+nonce across chains).
3. Victim (liquidator) deposits 11000e18 of the now-real token into the vault.
4. Attacker withdraws and receives most of the victim's deposited tokens.
**How found:** Noticed solmate SafeTransferLib lacks the OZ SafeERC20 code-existence check, then reasoned about cross-chain same-address token deployments (1INCH, Gelato $GEL) to construct a trap scenario.
**Exploitation:** Pre-create vaults at predictable future token addresses; when the real token lands there, victim deposits are absorbed and the attacker withdraws them, since earlier codeless transfers were silently treated as successful.
**Insight:** When a protocol uses solmate SafeTransferLib, check whether vault/market creation validates token code; predictable same-address cross-chain deployments let you pre-register markets for tokens that don't exist yet and capture later deposits.