# Anyone can call the flashRepayFromColl function for any loan

TermMax router's flashRepayFromColl lacks caller authorization, letting anyone repay another borrower's loan with zero slippage protection, causing fee loss or collateral loss.

- Payout: Contest reward
- Severity: high
- Program: TermMax
- Credited: Nyksx
- Disclosed: 2025-03-25
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_max_december2024.pdf#3.1.5
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.5
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** GT loan router flashRepayFromColl function
**Root cause:** flashRepayFromColl does not verify msg.sender is the loan owner, and the swap path uses minAmountOut=0, so any caller can trigger repayment with unbounded slippage.
**Steps:**
1. Create a loan via `_loan(poolFee)` to obtain a GT NFT id
2. Read `res.gt.loanInfo(gtId)` to get debtAmt and collateralData
3. Approve router for collateral amount decoded from collateralData
4. Build SwapUnit[] path collateral->underlying with minAmountOut=0
5. From arbitrary address call `router.flashRepayFromColl(sender, res.market, gtId, units)`
**How found:** Reviewer read flashRepay/flashRepayFromColl flow and noticed no owner check on the router entrypoint combined with zero slippage in swap units.
**Exploitation:** Attacker calls flashRepayFromColl for a victim's loan; collateral is transferred out and swapped with minAmountOut=0, debt repaid, NFT burned, leaving borrower with fee loss and potential collateral loss from unfavorable swap.
**Insight:** On lending/repay routers, check whether repay/close entrypoints enforce loan-owner auth and whether swap paths hardcode minAmountOut=0 — third parties can force-close positions at bad prices.