# Missing access control in admin_withdraw_all_swap_fee operation

admin_withdraw_all_swap_fee lacked operator access control, letting any authenticated user trigger fee distribution and profit via opportunistic stake/unstake.

- Payout: Contest reward
- Severity: high
- Program: Super Sushi Samurai
- Credited: 0xluk3
- Disclosed: 2025-05-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_super_sushi_samurai_march2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Asuper_sushi_samurai_march2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:fee-bypass

**Target:** Chromia Rell staking/swap contract operation admin_withdraw_all_swap_fee
**Root cause:** admin_withdraw_all_swap_fee lacks the operator auth hook applied to admin_withdraw_swap_fee in src/contracts/common/auth.rell, so any authenticated user can move accumulated Uniswap fees into the staking treasury.
**Steps:**
1. Accumulate fees in the Uniswap treasury over time.
2. As any authenticated user, stake a large amount of tokens (possibly borrowed).
3. Call `admin_withdraw_all_swap_fee()` to push fees into the staking treasury, appreciating xtoken exchange rate.
4. Unstake immediately to realize profit above staked amount.
**How found:** Compared admin_withdraw_all_swap_fee against the operator-protected admin_withdraw_swap_fee and noticed the missing auth hook plus inconsistent naming/docs.
**Exploitation:** Attacker stakes a dominant share, triggers fee withdrawal to inflate xtoken value, then unstakes to capture yield that would otherwise go to long-term stakers; flash loans could remove upfront capital need.
**Insight:** When auditing, diff sibling admin functions for asymmetric auth hooks; a missing operator check on a fee-distribution function becomes a yield-sniping primitive via stake-then-trigger-then-unstake.