# Permissionless creation of new subnets under gateway will lead to gateway actor fund draining

GatewayManagerFacet.register() lacks caller authorization, letting an attacker register a malicious subnet and releaseStake() to drain gateway-held collateral.

- Payout: Contest reward
- Severity: high
- Program: Recall
- Credited: sin1st3r__
- Disclosed: 2026-03-13
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-recall#h-08
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-recall%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** GatewayManagerFacet smart contract (subnet registration/stake release)
**Root cause:** register() never verifies msg.sender is authorized to create a subnet under the gateway, and releaseStake() trusts the subnet's mutable collateralSource, so a malicious subnet can swap its collateral token after registering.
**Steps:**
1. Deploy malicious subnet actor with collateralSource/supplySource pointing to attacker-controlled ERC20.
2. Call `GatewayManagerFacet.register(0, 10000)` from the malicious subnet; stake recorded as 10000.
3. Change the subnet's collateralSource token to USDT.
4. Call `GatewayManagerFacet.releaseStake(10000)`; gateway sends 10000 USDT to attacker.
5. Alt: register with genesisCircSupply=1000 ETH and collateral=1000 ETH, send only msg.value=1000 ETH; `require(msg.value >= value)` passes twice.
**How found:** Read the contest spec stating gateways should restrict subnet creation, then code-read register() and createSubnetId() and noticed no caller allowlist check; also spotted the double `msg.value >= value` check enabling underfunding.
**Exploitation:** Attacker registers a permissionless subnet with a fake collateral token, then repoints collateralSource to the gateway's real asset (USDT/ETH) and calls releaseStake to withdraw gateway funds backing all subnets.
**Insight:** When a contract custodies shared 'omnibus' funds across tenants, verify every entry point that adds a tenant enforces the single-tenant restriction the design assumes; also audit mutable source/token pointers used later by withdrawal functions.