# Vault.mintYieldFee function can be called by anyone to mint Vault Shares to any recipient address

PoolTogether Vault.mintYieldFee lacked access control and took an arbitrary _recipient, letting anyone mint accrued yield-fee shares to themselves.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: Udsen
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/396
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Vault.sol mintYieldFee external function
**Root cause:** mintYieldFee is external with no access control and accepts a caller-supplied _recipient instead of using the stored _yieldFeeRecipient, so anyone can direct minted yield-fee shares to themselves.
**Steps:**
1. Identify Vault.mintYieldFee(uint256 _shares, address _recipient) as external with no onlyRole/owner check.
2. Confirm it only reverts if vault under-collateralized or _shares > _yieldFeeTotalSupply.
3. Call `mintYieldFee(_yieldFeeTotalSupply, attackerAddress)` from any EOA.
4. Receive minted Vault shares representing the accrued yield fee.
**How found:** Code reading of the external mintYieldFee function: noticed missing access control and that the _recipient parameter shadows the constructor-set _yieldFeeRecipient state variable.
**Exploitation:** Attacker calls mintYieldFee with _shares equal to accrued _yieldFeeTotalSupply and _recipient set to their own address; contract decrements _yieldFeeTotalSupply and _mints the shares to the attacker, who can redeem them for underlying assets.
**Insight:** When a contract stores a privileged recipient (e.g. _yieldFeeRecipient) in its constructor, check every function that pays out to a recipient — if it takes a recipient parameter instead of the stored one, the stored value is dead and the payout is hijackable.