# Reward token in GaugeFactoryCL can be drained by anyone

Unauthenticated createGauge on GaugeFactoryCL seeds a 1e10 reward incentive per call, letting anyone drain pre-funded reward tokens into attacker-controlled farms.

- Payout: Contest reward
- Severity: high
- Program: Blackhole
- Credited: danzero
- Disclosed: 2025-07-03
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-05-blackhole#h-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** GaugeFactoryCL.createGauge / Algebra eternal farming seeding
**Root cause:** createGauge is externally callable with no access control and unconditionally approves and seeds 1e10 of the caller-supplied reward token into a new Algebra eternal farming incentive.
**Steps:**
1. Admin pre-funds GaugeFactoryCL with reward tokens (e.g. 5e10 USDC).
2. Attacker calls `GaugeFactoryCL.createGauge(USDC, ve, targetPool, attacker, attacker, attacker, true, farmingParams, address(0))`.
3. createGauge invokes internal createEternalFarming, which does `IERC20(USDC).safeApprove(algebraEternalFarming, 1e10)`.
4. AlgebraEternalFarming.createEternalFarming pulls 1e10 USDC via `_receiveToken`/`safeTransferFrom` from GaugeFactoryCL.
5. Repeat 5x to drain the full 5e10 balance.
6. Stake an LP NFT via `GaugeCL.deposit(tokenId)` into the spam gauge, then call `AlgebraEternalFarming.claimReward(USDC, attacker, 0)` to collect.
**How found:** Code review of GaugeFactoryCL noticed createGauge lacked access control and that createEternalFarming hardcodes a 1e10 reward approval, implying pre-funded tokens could be siphoned by any caller.
**Exploitation:** Attacker repeatedly calls the permissionless createGauge with their own pool and distribution addresses, each call moving a fixed 1e10 reward token from the factory into a fresh Algebra farm they control; they then deposit an LP NFT and claim the seeded rewards.
**Escalation:** Looping createGauge scales the drain to the factory's entire reward-token balance.
**Insight:** When a factory seeds incentives with a hardcoded amount and approves a downstream contract, check whether the seeding entrypoint is permissionless — the fixed reward becomes a per-call extraction primitive against any pre-funded balance.