# VeloCore: missing access control on velocore__execute drains pool

VeloCore's pool execute lacked access control, letting attacker call velocore__execute directly to mint VLP and drain $6.88M via SwapFacet.

- Payout: Real-world hack
- Severity: critical
- Program: VeloCore
- Credited: DeFiHackLabs
- Disclosed: 2024-06-01
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-06/Velocore_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240601-velocore
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ConstantProductPool / SwapFacet on Linea
**Root cause:** velocore__execute on the pool was externally callable without access control, allowing arbitrary manipulation of pool balances and VLP supply outside the vault's accounting.
**Steps:**
1. Fork Linea at block 5079176
2. Call `ConstantProductPool(USDC_ETH_VLP).velocore__execute(address(this), [USDC_e, USDC_ETH_VLP], [170141183460469231731687303715884105727, 8616292632827688], "")` three times
3. Read `poolBalances()` to confirm inflated VLP balance
4. Call `SwapFacet.execute(tokenRef, deposit, ops)` with 4 crafted VelocoreOperation entries encoding tokenInformations to swap out USDC_e
5. Check USDC_e balance for profit
**How found:** Likely source review of the pool contract revealing velocore__execute was public and unguarded, then crafting extreme int128 amounts to exploit the accounting.
**Exploitation:** Attacker directly invoked the pool's velocore__execute three times with extreme int128 amounts to inflate their VLP balance, then routed a 4-op SwapFacet.execute to convert the inflated VLP into USDC_e, extracting ~$6.88M.
**Insight:** On vault/pool architectures, check whether internal pool entrypoints (velocore__execute-style) are externally callable and skip the vault's accounting; direct pool calls can mint shares or skew balances outside intended invariants.