# Pool tokens can be stolen via PrivatePool.flashLoan function from previous owner

PrivatePool owner pre-approves attacker contract via execute; after selling pool NFT, attacker calls flashLoan with malicious token to drain all assets.

- Payout: Contest reward
- Severity: medium
- Program: Caviar
- Credited: Brenzee
- Disclosed: 2023-05-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-caviar-findings/issues/230
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-caviar%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** PrivatePool.sol flashLoan/execute
**Root cause:** flashLoan accepts an arbitrary caller-supplied token address and calls transferFrom on it, so a malicious contract can impersonate the NFT and pull pre-approved tokens; execute lets owner grant unlimited approvals to arbitrary targets.
**Steps:**
1. Bob creates PrivatePool with 5 ERC721 + 500 USDC.
2. Bob deploys PrivatePoolExploit implementing onFlashLoan, transferFrom, ownerOf, onERC721Received, attack.
3. Bob calls PrivatePool.execute to approve USDC max and setApprovalForAll for ERC721 to the exploit contract.
4. Bob sells the PrivatePool ownership NFT to Alice on a marketplace.
5. Bob calls PrivatePoolExploit.attack -> PrivatePool.flashLoan(receiver=exploit, tokenId, data).
6. flashLoan calls exploit.transferFrom, draining approved tokens.
**How found:** Code reading of flashLoan: noticed the token address is caller-controlled and used in transferFrom, combined with execute allowing arbitrary approvals.
**Exploitation:** Attacker pre-arms approvals via execute, sells pool ownership, then triggers flashLoan with a fake token contract whose transferFrom pulls the pre-approved assets from the pool.
**Insight:** When a contract's ownership is transferable (ERC721), any approvals/state set by the prior owner persist; check flashLoan-style functions that trust caller-supplied token addresses for transferFrom.