# Anyone can call repayLoan on the borrower and pull funds from their account to repay loan

Hyperlend P2P repayLoan pulls repayment from the borrower's wallet regardless of caller, letting a malicious lender force immediate repayment and pocket interest.

- Payout: Contest reward
- Severity: high
- Program: Hyperlend
- Credited: Joshuajee
- Disclosed: 2025-01-12
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_hyperlend_november2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Ahyperlend_november2024%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** LendingP2P.sol repayLoan lending contract
**Root cause:** repayLoan uses safeTransferFrom(_loan.borrower, ...) instead of msg.sender, so any caller can spend the borrower's approved allowance to settle the loan.
**Steps:**
1. Borrower approves the LendingP2P contract for asset and collateral (often max approval).
2. Borrower calls `requestLoan(encodedLoan)` with repaymentAmount > assetAmount.
3. Lender calls `fillRequest(0)` to fund the loan.
4. Lender immediately calls `repayLoan(0)`; contract pulls `amountToLender` and `protocolFee` from borrower via `safeTransferFrom(_loan.borrower, ...)`.
5. Borrower loses interest+fees without ever using the loan; lender receives principal+interest.
**How found:** Code review of repayLoan noticed the transfer source is `_loan.borrower` rather than `msg.sender`, meaning caller identity is irrelevant to who pays; PoC confirms lender profits by immediate repayment.
**Exploitation:** Malicious lender fills a borrower's loan request then instantly calls repayLoan, which transfers repaymentAmount from the borrower's pre-approved balance to the lender and protocol fee collector, netting the lender the interest while the borrower pays for an unused loan.
**Insight:** In P2P lending contracts, check every transferFrom source: if it's a stored party address rather than msg.sender, any approved allowance becomes spendable by third parties — especially dangerous when borrowers grant max approvals.