# BaseTOFT.sol: removeCollateral can be used to manipulate other user's positions and steal tokens due to absent approval check

Cross-chain removeCollateral in BaseTOFT lacks msg.sender allowance check, letting anyone trigger collateral removal on a victim's market position via LayerZero.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: carrotsmuggler
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1031
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-35
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:auth-bypass

**Target:** BaseTOFT cross-chain market module (removeCollateral)
**Root cause:** removeCollateral accepts arbitrary `from`/`to` and forwards a LayerZero message without verifying the original caller's allowance; on the destination chain the market sees msg.sender as the trusted TOFT contract, which already holds user approvals.
**Steps:**
1. Attacker calls `BaseTOFT.removeCollateral(from=victim, to=victim, ...)` on source chain; no allowance check on msg.sender.
2. `BaseTOFTMarketModule.removeCollateral` packs `(PT_MARKET_REMOVE_COLLATERAL, from, to, toAddress, removeParams, withdrawParams, approvals)` and lzSend to destination.
3. Destination lzEndpoint calls TOFT; payload decoded, `to` taken from attacker-controlled field.
4. TOFT calls `IMarket(removeParams.market).removeCollateral(to, to, removeParams.share)`; market trusts msg.sender=TOFT and executes against victim's position.
5. Victim's collateral withdrawn, health factor drops; attacker directs `to` to own address to steal tokens.
**How found:** Code review of cross-chain message flow: noticed removeCollateral takes user-supplied `from`/`to` with no allowance check, and that on the destination chain msg.sender becomes the trusted TOFT contract which already holds user approvals — so the market cannot distinguish attacker from victim.
**Exploitation:** Attacker needs only gas on source chain; victim must have prior approval to the TOFT contract (standard for cross-chain use). Attacker sets from/to to victim (or to attacker) and triggers removal of victim's collateral shares, redirecting withdrawn tokens to attacker-controlled `to`.
**Escalation:** Same missing-approval vector applies to retrieveFromStrategy and other cross-chain ops, enabling draining of victim positions across markets.
**Insight:** In LayerZero/OFT-style cross-chain designs, the destination contract sees msg.sender as the trusted endpoint/TOFT, not the original user; any function that forwards user-supplied `from`/`to` without checking allowance on the source chain becomes an unauthenticated proxy for that user's approvals.