# Unauthorized Access to setCurves Function

FeeSplitter.setCurves lacked access control, letting anyone repoint the Curves reference to a fake contract and inflate claimable fees.

- Payout: Contest reward
- Severity: high
- Program: Curves Protocol
- Credited: parlayan\_yildizlar\_takimi
- Disclosed: 2024-07-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-curves-findings/issues/4
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-curves%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** FeeSplitter.sol setCurves function (Solidity smart contract)
**Root cause:** setCurves is public with no onlyOwner/onlyManager modifier, so any caller can replace the trusted Curves contract reference used for fee calculations.
**Steps:**
1. Deploy FeeSplitter and a FakeCurves contract.
2. As attacker call `feeRedistributor.setCurves(fakeCurves)` — succeeds with no auth.
3. On FakeCurves call `setCurvesTokenSupply(randomToken, 250)` and `setCurvesTokenBalance(randomToken, attacker, 249)`.
4. Call `feeRedistributor.getClaimableFees(randomToken, attacker)` which now returns 996000000000000000 based on fake values.
5. Claim the inflated fees not actually owed.
**How found:** Code review of FeeSplitter.sol noticing setCurves is public without an access-control modifier, then testing the repoint-and-inflate path in a local PoC.
**Exploitation:** Attacker repoints FeeSplitter's curves reference to a malicious contract they control, sets arbitrary token balance/supply values, then claims fees computed from those fabricated numbers, draining value owed to legitimate holders.
**Insight:** On fee-distributor/accounting contracts, audit every setter that swaps a trusted external contract reference — a missing onlyOwner on a 'config' setter silently converts all downstream balance math into attacker-controlled input.