# MagnetarMintXChainModule.sol:mintBBLendXChainSGL can be used to manipulate user positions by abusing whitelist privileges

Magnetar's mintBBLendXChainSGL lets attacker set arbitrary data.user in cross-chain compose, so whitelisted USDO executes depositYBLendSGLLockXchainTOLP on victim's behalf, manipulating their positions.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: carrotsmuggler
- Disclosed: 2024-05-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/185
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** MagnetarMintXChainModule / MagnetarAssetXChainModule cross-chain compose
**Root cause:** _checkSender allows whitelisted callers (USDO) to act on any _from; mintBBLendXChainSGL does not validate that the lzcompose data.user matches the original caller, so attacker-controlled user field reaches depositYBLendSGLLockXchainTOLP via whitelisted USDO.
**Steps:**
1. Attacker calls `mintBBLendXChainSGL` on chain A with `data.lendSendParams.lzParams.sendParam.composeMsg` encoding a `DepositAndSendForLockingData` struct whose `user` is the victim address.
2. Magnetar sends packet via USDO on chain A; lzReceive on chain B triggers USDO `sendCompose` and `lzcompose`.
3. USDO (whitelisted) calls `depositYBLendSGLLockXchainTOLP` on Magnetar chain B with attacker-supplied `data.user` = victim.
4. `_checkSender` passes because msg.sender is whitelisted USDO; Magnetar pulls victim's tokens (victim had approved Magnetar) and performs market operations on victim's behalf.
**How found:** Code reading of _checkSender whitelist logic and tracing the cross-chain compose flow: noticed mintBBLendXChainSGL encodes DepositAndSendForLockingData into composeMsg without validating user, and that USDO is whitelisted, so the user field is attacker-controlled on chain B.
**Exploitation:** Attacker needs victim to have granted allowance to Magnetar. Attacker crafts cross-chain message with victim as data.user; whitelisted USDO executes deposit/lend/lock operations using victim's funds, manipulating victim's market position and extracting tokens.
**Escalation:** Any other cross-chain path that triggers USDO lzcompose to Magnetar can similarly abuse the whitelist, not just mintBBLendXChainSGL.
**Insight:** When a trusted/whitelisted contract relays user-supplied structs, audit every field of that struct for authorization: the relay's privilege overrides per-user checks, so any unvalidated user/from field becomes an impersonation primitive.