# Admin configuration isAllowedForCollateral(mode, pool) can be bypassed by donating asset to the pool directly and then trigger sync cash via flashloan

Donating tokens to a lending pool then calling flash triggers syncCash, inflating share value and bypassing admin's isAllowedForCollateral restriction to borrow funds out.

- Payout: Contest reward
- Severity: medium
- Program: INIT Capital
- Credited: ladboy233
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-initcapital-findings/issues/3
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** Lending pool / InitCore collateral accounting
**Root cause:** syncCash trusts the pool's raw token balance, so direct donations inflate cash and thus share-to-amount conversion, letting a disallowed pool be collateralized.
**Steps:**
1. Admin disallows pool A via isAllowedForCollateral(mode, poolA).
2. Attacker acquires/mints token A and transfers it directly to the lending pool.
3. Attacker calls `flash(pools, amts, ...)` on InitCore; after callback, syncCash() runs and sets cash = balanceOf(pool).
4. Inflated cash raises toAmtCurrent(shares) value in collateral credit calc.
5. Attacker collateralizes the disallowed pool and borrows against inflated value.
**How found:** Code review of collateralize's isAllowedForCollateral check and the flash path calling syncCash, noticing syncCash reads raw balanceOf so donations count as cash.
**Exploitation:** Attacker donates (e.g. infinitely minted) tokens to the lending pool, invokes flash to force syncCash, inflating share worth, then collateralizes the disallowed pool and borrows all funds out, creating bad debt.
**Escalation:** Combined with an infinite-mint vulnerability in the disallowed token to maximize donated value and drain the pool.
**Insight:** When an allowlist gates collateral, check whether share price derives from raw token balance; any permissionless balance-sync (flash, skim, sync) lets donations bypass the gate.