# tOLP positions created through MagnetarAction.Permit can be stolen

Magnetar's Permit action lets anyone approve themselves on whitelisted tokens, stealing tOLP positions left stuck in the contract by TapToken participation.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: immeas
- Disclosed: 2024-05-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/176
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic

**Target:** Magnetar contract (MagnetarAction.Permit / TapToken / OFT)
**Root cause:** MagnetarAction.Permit validates only that the first calldata arg equals msg.sender, but for setApprovalForAll/approve the first arg is the operator/approvee, so a caller can approve themselves. TapToken participation mints the oTAP position to msg.sender (Magnetar), leaving it stuck and retrievable by anyone.
**Steps:**
1. User calls MagnetarAction.TapToken -> TapiocaOptionBroker::participate mints oTAP position to Magnetar (msg.sender), leaving it stuck
2. Attacker builds MagnetarCall{id: MagnetarAction.Permit, target: oTAP, call: abi.encodeWithSelector(IERC721.setApprovalForAll.selector, attacker, true)}
3. Attacker calls `magnetar.burst(calls)`; _checkSender passes since first arg == msg.sender
4. Attacker calls `oTAP.transferFrom(address(magnetar), attacker, 1)` and owns the position
**How found:** Code reading of MagnetarStorage::_checkSender comparing only the first calldata argument against msg.sender, combined with noticing TapToken mints to msg.sender (Magnetar) and Permit/OFT allow arbitrary calls to whitelisted targets.
**Exploitation:** Attacker self-approves via Permit on the whitelisted oTAP (or YieldBox/ERC20) contract, then transfers the stuck position/tokens out of Magnetar to their own address.
**Escalation:** Chains three issues: TapToken leaves position stuck in Magnetar, Permit self-approval, and unvalidated OFT call to whitelisted contracts.
**Insight:** When an access check compares 'first calldata argument' to msg.sender, enumerate every whitelisted selector and check whether its first parameter is actually the caller or an operator/approvee/spender — approval functions invert that assumption.