# Lack of access control and value validation in the reward flow exposes functions to public access

AfEth and VotiumStrategy depositRewards() lack access control and don't check _amount==msg.value, letting anyone spend ETH held by the contracts to buy and lock CVX.

- Payout: Contest reward
- Severity: medium
- Program: Asymmetry Finance
- Credited: adriro
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/38
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-07
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** Solidity reward-flow contracts (AfEth, VotiumStrategyCore)
**Root cause:** depositRewards() in both AfEth and VotiumStrategyCore is public with no caller validation and no check that the _amount argument equals msg.value, so the amount is trusted independently of ETH actually sent.
**Steps:**
1. Identify AfEth.depositRewards(uint256 _amount) payable at AfEth.sol#L272 and VotiumStrategyCore.depositRewards(uint256 _amount) payable at VotiumStrategyCore.sol#L203.
2. Note neither has a modifier restricting caller to rewarder/manager/vEthAddress.
3. Call `AfEth.depositRewards(largeAmount)` with msg.value=0; feeAmount computed from _amount, remainder routed to stake or votiumStrategy.depositRewards{value: amount}.
4. Call `VotiumStrategyCore.depositRewards(_amount)` directly to trigger buyCvx(_amount), approve and lock into vlCVX, spending any ETH balance held by the contract.
**How found:** Code review of the Votium reward flow (claimRewards -> applyRewards -> AfEth.depositRewards -> VotiumStrategy.depositRewards) revealed the callback steps lacked access control and amount-vs-msg.value validation.
**Exploitation:** Any account calls the public depositRewards() with an arbitrary _amount while sending little or no ETH; the contracts then spend their own ETH balance to buy CVX and lock it in vlCVX, or forward value to SafEth staking. Attacker cannot directly extract funds but can grief/unauthorizedly spend contract ETH; sandwiching the swap is a possible indirect gain.
**Insight:** When tracing a privileged multi-contract flow, check each callback/step function individually for missing modifiers and for parameters that duplicate msg.value — the outer entrypoint being gated doesn't protect the inner ones.