# Attacker can deploy vaults with a malicious Staking contract

Popcorn's deployVault accepts any staking contract address without template-registry validation, letting attackers attach a backdoored staking contract that drains user deposits.

- Payout: Contest reward
- Severity: high
- Program: Popcorn
- Credited: gjaldon
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/275
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** VaultController.deployVault / VaultRegistry staking registration
**Root cause:** deployVault takes an arbitrary staking address and registers it in VaultRegistry without checking it against approved Staking templates in the Template Registry.
**Steps:**
1. Register valid Adapter/Strategy/Vault templates via addTemplate
2. Deploy a malicious MultiRewardStaking contract with a backdoor withdraw-all function
3. Call `controller.deployVault(params, vaultArgs, adapterArgs, address(maliciousStaking), "", metadata, 0)` as any user
4. Observe `vaultRegistry.getVault(vault).staking == address(maliciousStaking)` with no validation
5. Lure users to deposit into the vault's staking contract; attacker drains via backdoor
**How found:** Code review of deployVault's staking parameter handling and VaultRegistry registration, noticing no template-registry check on the supplied staking address.
**Exploitation:** Attacker deploys a staking contract mimicking ERC-4626 behavior but with a privileged function to withdraw all deposited funds, attaches it to a vault via deployVault, and users deposit believing it is a legitimate template-deployed staking contract.
**Insight:** When a factory accepts a contract address as a parameter, check whether it validates that address against the template/implementation registry — unvalidated external contract references become trust-confusion vectors for users.