# BuilderWallet init() is unprotected/re-initializable, enabling takeover and theft of builder fees

BuilderWallet.init() lacked access control and a one-time guard, letting anyone overwrite builderAdmin and sweep() all ERC20 fees from any builder wallet.

- Payout: Contest reward
- Severity: high
- Program: Panoptic
- Credited: darf_tech
- Disclosed: 2026-03-09
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-12-panoptic-next-core#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:auth-bypass

**Target:** BuilderWallet contract (RiskEngine.sol) deployed via BuilderFactory
**Root cause:** init() sets builderAdmin with no access control and no initialized guard, so it remains callable after CREATE2 deployment and overwrites the admin.
**Steps:**
1. Builder wallet deployed via BuilderFactory.deployBuilder(...) which calls BuilderWallet(wallet).init(builderAdmin) (RiskEngine.sol L2371)
2. Wallet accumulates ERC20 fee/token balances
3. Attacker calls `BuilderWallet.init(attacker)` to overwrite builderAdmin (L2315)
4. Attacker calls `BuilderWallet.sweep(token, attacker)` to drain balances (L2319)
**How found:** Code review of BuilderWallet: noticed init() lacked access control and an only-once guard while sweep() trusted builderAdmin, and that BuilderFactory calls init() post-deployment leaving it callable.
**Exploitation:** Attacker re-invokes the unprotected init() on any deployed builder wallet to set builderAdmin to their own address, then calls sweep(token, attacker) which passes the builderAdmin authorization check, draining all ERC20 balances including protocol-distributed fees and shares.
**Insight:** For factory-deployed contracts using an init() pattern instead of a constructor, check that init() has both access control and an initialized flag; any admin-gated function downstream (like sweep) inherits the takeover.