# vault.changeAdapter can be misused to drain fees

Anyone can re-call vault.changeAdapter to re-deposit into the same fee-charging adapter, repeatedly burning withdrawal fees from user funds.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: Lirios
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/515
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Vault.changeAdapter / ERC4626 adapter
**Root cause:** changeAdapter lacks onlyOwner and does not clear proposedAdapterTime, so after the owner's change any user can re-trigger _protocolWithdraw/_protocolDeposit against the same adapter.
**Steps:**
1. Deploy vault with a fee-charging adapter (e.g. BeefyAdapter, 0.1% withdrawal fee) and deposit funds.
2. Owner calls `proposeAdapter(newAdapter)`, waits quitPeriod, calls `changeAdapter()`.
3. Any user repeatedly calls `vault.changeAdapter()`; each call withdraws all assets from adapter and re-deposits to same adapter.
4. Each round pays the adapter's withdrawal fee; 10 rounds lose ~1% of assets (test shows 2e18 -> 1.98e18).
**How found:** Code reading of changeAdapter: noticed proposedAdapter persists after change, allowing re-invocation; hypothesized fee-charging adapters would leak value per round, confirmed with a fee-simulating mock.
**Exploitation:** Attacker (any user) spams changeAdapter after owner's legitimate adapter change; each call forces full withdraw+deposit through the fee-charging adapter, siphoning a fee percentage per round to the adapter/underlying vault.
**Escalation:** Repeated calls scale loss linearly with fee percentage; griefing/MEV-style drain of user funds.
**Insight:** After a one-time privileged state transition, check whether the triggering state variable is reset; any function that moves all funds through an external adapter is a fee/slippage sink if re-callable by anyone.