# BeefyAdapter() malicious vault owner can use malicious \_beefyBooster to steal the adapter's token

BeefyAdapter trusts owner-supplied _beefyBooster and grants it max approval on the Beefy vault, letting a malicious booster transferFrom all adapter-held tokens.

- Payout: Contest reward
- Severity: high
- Program: Popcorn
- Credited: bin2chen
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/552
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BeefyAdapter initialize / _protocolDeposit
**Root cause:** initialize decodes _beefyBooster from owner-controlled beefyInitData without checking it against the PermissionRegistry, then approves it for type(uint256).max on the Beefy vault.
**Steps:**
1. Vault owner deploys malicious contract implementing IBeefyBooster with stakedToken() returning the legitimate _beefyVault.
2. Owner creates BeefyAdapter passing (_beefyVault, maliciousBooster) as beefyInitData.
3. initialize approves maliciousBooster for max on _beefyVault.
4. Users deposit; _protocolDeposit calls beefyBooster.stake(...).
5. Malicious booster calls _beefyVault.transferFrom(adapter, attacker, balance) to drain all adapter-held vault tokens.
**How found:** Code reading of initialize: noticed _beefyVault is checked against the PermissionRegistry but _beefyBooster is not, while still receiving max approval.
**Exploitation:** Owner-controlled booster contract abuses the unlimited ERC20 approval granted during initialize to pull the adapter's entire Beefy vault token balance via transferFrom.
**Insight:** When a contract grants max approval to an address decoded from user-supplied init data, check whether that address is validated against the same endorsement/allowlist as the primary token; asymmetric validation of paired addresses is a recurring drain vector.