# Prohibition to create private pools with the factory NFT

PrivatePool allowed the Factory NFT as its pool NFT, letting an attacker flashloan a pool NFT and withdraw the victim pool's assets.

- Payout: Contest reward
- Severity: medium
- Program: Caviar
- Credited: hihen
- Disclosed: 2023-05-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-caviar-findings/issues/353
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** PrivatePool / Factory NFT
**Root cause:** PrivatePool constructor does not reject the Factory contract address as the pool's NFT, so a pool can hold Factory NFTs that represent ownership of other PrivatePools.
**Steps:**
1. Deploy p1 with `nft = address(Factory)` and deposit `uint256(p2)` (the Factory NFT of p2) into p1.
2. Attacker calls `p1.flashloan()` borrowing `uint256(p2)`.
3. In the flashloan callback call `p2.withdraw(...)` to drain p2's base tokens and NFTs.
4. Return `uint256(p2)` to p1 to satisfy the flashloan.
**How found:** Code review of PrivatePool constructor and flashloan/withdraw paths; noticed Factory NFTs are ERC721s representing pool ownership and are accepted as pool NFTs, making them composable vault-like assets that should not be flashloanable.
**Exploitation:** Flashloan the Factory NFT representing a victim PrivatePool from a pool that accepts Factory NFTs, then in the callback invoke withdraw() on the victim pool to drain its base tokens and NFTs, repaying the loan.
**Escalation:** Same primitive also drains the lending pool itself via `p1.withdraw()` in the callback, or via buy/sell of the Factory NFT.
**Insight:** When a protocol mints NFTs that represent ownership/control of other protocol objects, check whether those NFTs can be used as collateral or flashloanable assets in sibling contracts — flashloaning an ownership token lets you exercise its privileges mid-transaction.