# An attacker can steal debt tokens by using the user's gtID

TermMaxRouter.borrowTokenFromGt never checks gtId ownership, so an attacker front-running a user's approval can borrow against the victim's gtId and receive the debt tokens.

- Payout: Contest reward
- Severity: high
- Program: Term Structure
- Credited: Nyksx
- Disclosed: 2025-03-20
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_structure_february2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** TermMaxRouter.borrowTokenFromGt / TermMaxMarket gt positions
**Root cause:** borrowTokenFromGt accepts an arbitrary gtId and recipient without verifying msg.sender owns the gtId; the router is approved as operator so it can augment debt on any approved position.
**Steps:**
1. Victim approves router for xt and gt (gtId) to enable borrowing.
2. Attacker acquires borrowAmt of XT and approves router.
3. Attacker front-runs with `router.borrowTokenFromGt(attacker, market, victimGtId, borrowAmt)`.
4. Router calls `market.issueFtByExistedGt(address(this), debtAmt, gtId)` on victim's position, pulls attacker's XT, and `market.burn(attacker, borrowAmt)` mints debt tokens to attacker.
**How found:** Code review of borrowTokenFromGt noticed the router acts as caller of gt.augmentDebt via user approval, and no ownership check on gtId or binding of recipient to msg.sender, implying front-run theft.
**Exploitation:** Attacker monitors mempool for victim's approval/borrow tx, supplies only XT tokens, and redirects the debt-token output to their own address using the victim's gtId, capturing the borrowed debt tokens.
**Insight:** When a router is granted operator rights over a position NFT/id, check every entrypoint that takes that id as a parameter for an owner==msg.sender check; front-running the approval tx lets anyone spend the victim's credit line.