# InitialETHCrowdfund + ReraiseETHCrowdfund: Gatekeeper checks wrong address

InitialETHCrowdfund and ReraiseETHCrowdfund pass contributor instead of msg.sender to gatekeeper.isAllowed, letting non-whitelisted users contribute on behalf of whitelisted addresses.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: HollaDieWaldfee
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-04-party-findings/issues/6
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-party%3AM-09
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:access-control vuln:auth-bypass

**Target:** ETH crowdfund contracts (InitialETHCrowdfund, ReraiseETHCrowdfund)
**Root cause:** Gatekeeper allowlist check uses the `contributor` argument rather than `msg.sender`, so the caller's identity is never validated against the allowlist.
**Steps:**
1. Configure a crowdfund with a gatekeeper allowlisting only Alice, Bob, Chris.
2. From an unauthorized address, call `contributeFor(Alice, ...)` (or contribute with contributor=Alice).
3. Observe `gateKeeper.isAllowed(contributor=Alice, ...)` returns true and the contribution succeeds despite msg.sender not being allowlisted.
4. Compare with legacy `Crowdfund._contribute` which correctly passes `msg.sender`.
**How found:** Compared the new crowdfund contracts against the already-audited legacy `Crowdfund.sol`, noticing the argument to `gatekeeper.isAllowed` differed (contributor vs msg.sender); also noted `batchContributeFor` self-call makes msg.sender the contract.
**Exploitation:** Any non-whitelisted address contributes by naming a whitelisted address as the contributor, bypassing the gatekeeper allowlist and gaining crowdfund participation/party membership intended to be restricted.
**Insight:** When new contracts fork audited ones, diff the security-critical call sites (allowlist/auth checks) argument-by-argument against the original; a swapped parameter like contributor vs msg.sender silently inverts who is validated.