# An attacker could manipulate debt exceptional redistribution because it is allowed to deposit into any trove

Permissionless deposit into any trove lets an attacker force a victim's trove to hold a volatile yang, redirecting exceptional bad-debt redistribution onto the victim.

- Payout: Contest reward
- Severity: medium
- Program: Opus
- Credited: minhquanym
- Disclosed: 2024-03-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-opus-findings/issues/115
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Abbot trove deposit / debt redistribution (Starknet Cairo)
**Root cause:** abbot.deposit() allows any caller to deposit into any trove, so an attacker can make a victim's trove the sole holder of a yang, converting exceptional redistribution into regular redistribution onto the victim.
**Steps:**
1. Attacker holds volatile yang X in their trove; no other trove holds X.
2. Attacker's trove becomes unhealthy and is due for redistribution.
3. Attacker calls `abbot.deposit(victim_trove_id, X_amount)` — no ownership check.
4. Victim's trove now holds X, so regular redistribution applies and all bad debt of X is allocated to the victim's trove.
**How found:** Code-reading of abbot.deposit() noting the comment that caller need not be trove owner, combined with understanding of exceptional vs regular redistribution logic.
**Exploitation:** Attacker deposits a small amount of the volatile yang into the victim's trove just before redistribution, forcing the victim to absorb the attacker's bad debt instead of it being spread across all yangs.
**Insight:** When a protocol has a special-case redistribution path (e.g. exceptional redistribution when no trove holds a yang), look for permissionless state-changing functions that let an attacker force another account into the normal path, shifting losses onto them.