# Liquidators can be tricked to operate with LiquidationPairs that were deployed using the LiquidationPairFactory but they configured the LiquidationSource as a fake malicious contract

LiquidationPairFactory accepts arbitrary _source, so a fake source contract makes LiquidationRouter send tokenIn to the attacker while swap is a no-op.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0xStalin
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-pooltogether-findings/issues/68
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-pooltogether%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LiquidationPairFactory / LiquidationRouter swapExactAmountOut
**Root cause:** createPair() does not validate that _source is a legitimate registered vault, and the router trusts pair.target() as the tokenIn recipient while the pair's swap can be a no-op.
**Steps:**
1. Attacker deploys FakeSource whose targetOf() returns attacker address and liquidate() returns true.
2. Attacker calls LiquidationPairFactory.createPair(FakeSource, tokenIn, tokenOut, ...) — pair is registered in deployedPairs.
3. Victim EOA calls LiquidationRouter.swapExactAmountOut(pair, receiver, amountOut, amountInMax).
4. Router safeTransferFrom's tokenIn to pair.target() == attacker address.
5. pair.swapExactAmountOut() calls FakeSource.liquidate() which returns true; no tokens delivered to victim.
**How found:** Read createPair() and noticed _source is unvalidated; cross-referenced protocol docs stating any factory-created pair is legitimate, then traced router flow to see tokenIn is sent to pair.target() before swap.
**Exploitation:** Attacker registers a malicious pair via the permissionless factory, lures EOA liquidators/bots into swapping through LiquidationRouter, and receives their tokenIn directly while the swap silently no-ops.
**Insight:** When a factory is the trust anchor for 'legitimate' contracts, check whether factory inputs are validated against a registry; also check whether routers send user funds to a target derived from the untrusted contract before verifying delivery.