# CIVNFT: missing access control drains victim CIV via fake pool

CIVNFT's unauthenticated 0x7ca06d68 function let an attacker spoof a Uniswap V3 pool and mint callback to drain ~$180k of CIV from a victim.

- Payout: Real-world hack
- Severity: high
- Program: CIVNFT
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-08
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/CIVNFT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230708-civnft
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** CIVNFT contract / Uniswap V3 mint callback
**Root cause:** A privileged function (selector 0x7ca06d68) lacked access control and trusted a caller-supplied pool address, letting anyone invoke the Uniswap V3 mint callback path against arbitrary victim balances.
**Steps:**
1. Fork mainnet at block 17649875.
2. Call CIVNFT with selector `0x7ca06d68`, passing attacker contract as fake pool, `abi.encodePacked("0.000059")`, tick `-97385`, amount `195476868337608980000000`, 0, true.
3. CIVNFT invokes mint on the fake pool, which calls back into CIVNFT via `0xd3487997` (uniswapV3MintCallback) with `abi.encode(victim, victim)`.
4. Callback transfers `CIV.balanceOf(victim)` from the victim to the attacker.
**Exploitation:** Attacker contract impersonates a Uniswap V3 pool, triggers the vulnerable mint path, and the callback pulls the victim's entire CIV balance to the attacker; ~$180k lost.
**Insight:** When a contract calls an external pool's mint and relies on the pool to invoke its own callback, an attacker-controlled pool address lets you forge the callback and pass arbitrary `from`/`to` in the data — check that the pool address is whitelisted and the payer is msg.sender-derived.