# User can give himself approval for all assets held by MagnetarV2 contract

MagnetarV2._permit fails to check the function selector, letting any user craft an approve/transfer call to gain allowance over assets held by the contract.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: 0xTheC0der
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/832
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-49
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** MagnetarV2.burst permit action (_permit)
**Root cause:** _permit only checks that the first decoded parameter equals msg.sender and that calldata length matches a permit call, but never verifies the 4-byte selector is ERC20.permit, so any function can be invoked on any target.
**Steps:**
1. Encode `approve(deployer, value)` calldata for target token
2. Pad it with trailing zeros to match the length of an encoded `permit(...)` call
3. Call `magnetar.burst([{id:2, target: token, value:0, allowFailure:false, call: paddedApprove}])`
4. MagnetarV2 executes approve with itself as msg.sender, granting allowance to attacker
**How found:** Code review of _permit: noticed target is free, selector unchecked, only first arg and calldata length constrained; realized any function with matching calldata length could be smuggled through the permit action.
**Exploitation:** Attacker submits a burst PERMIT action whose calldata is a padded approve/transfer call; MagnetarV2 executes it as itself, granting the attacker allowance over any ERC20/NFT the contract holds, then pulls the assets.
**Escalation:** Same primitive allows arbitrary calls (not just approve/transfer) on any target contract, potentially chaining into delegatecall paths like MagnetarMarketModule.
**Insight:** When a router validates calldata by decoding arguments and length but not the selector, look for functions whose ABI layout matches the expected call so you can substitute a privileged operation (approve/transfer) for the intended one.