# Anyone who uses same adapter has the ability to pause it

VaultController.pauseAdapters authorizes by vault creator, so anyone reusing a shared adapter can pause it and halt all vaults using it.

- Payout: Contest reward
- Severity: high
- Program: Popcorn
- Credited: rvierdiiev
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/292
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** VaultController / AdapterBase shared adapter
**Root cause:** pauseAdapters checks _verifyCreatorOrOwner against the caller's own vault, then calls pause on the shared adapter contract, so any creator of a vault referencing that adapter can pause it globally.
**Steps:**
1. Attacker deploys a vault via VaultController reusing an existing adapterA.
2. Attacker calls `pauseAdapters([attackerVault])`; _verifyCreatorOrOwner passes since attacker is creator.
3. adminProxy.execute calls `pause()` on adapterA, halting all vaults sharing it.
4. Repeat whenever someone unpauses.
**How found:** Code reading of pauseAdapters: noticed authorization is per-vault creator but the pause target is the shared adapter contract, so ownership of any vault grants control over the shared adapter.
**Exploitation:** Attacker creates a vault pointing at a victim's adapter, then calls pauseAdapters on their own vault to pause the shared adapter, blocking deposits and forcing strategy withdrawal so victim vaults stop earning yield; repeatable to keep it paused.
**Insight:** When an access check validates the caller against one object but the privileged action targets a shared/dependent contract, look for a way to create your own object referencing the victim's shared resource to pass the check.