# Can register a non-allowed collateral as collateral

Sentiment's controllers register any token returned by external calls as account collateral without checking the allowlist, letting attackers use unvetted tokens with oracles to inflate collateral and drain funds.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: Lambda
- Disclosed: 2022-08-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/029-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:oracle-manipulation

**Target:** AccountManager._updateTokensIn / UniV2, AaveV2/V3, Balancer controllers
**Root cause:** _updateTokensIn adds every token in tokensIn as an account asset without checking isCollateralAllowed; controllers pass through arbitrary tokens returned by external protocol calls (e.g. LP removal), so any token with an active oracle becomes collateral.
**Steps:**
1. Admin sets oracle for token XYZ but does not whitelist it in isTokenAllowed/isCollateralAllowed.
2. Attacker opens an account and provides XYZ/ETH liquidity on UniswapV2, transferring the LP to the account.
3. Attacker calls AccountManager.exec to remove liquidity via UniV2Controller.
4. Controller returns WETH + XYZ in tokensIn; _updateTokensIn registers XYZ as collateral without allowlist check.
5. riskEngine.isAccountHealthy passes because XYZ oracle is active.
6. Attacker manipulates XYZ price to inflate collateral and borrow/drain protocol funds.
**How found:** Code review of controller return-value handling and AccountManager._updateTokensIn, noticing no isTokenAllowed/isCollateralAllowed check on tokensIn while oracle check alone gates health.
**Exploitation:** Attacker supplies LP for a non-whitelisted token with an active oracle, removes liquidity through the account so the token is auto-registered as collateral, then manipulates its price to inflate collateral value and borrow against it to drain funds.
**Escalation:** Same pattern applies to AaveV2/V3 and Balancer controllers by transferring LP/aTokens directly and exiting via exec.
**Insight:** When a protocol auto-registers tokens from external call return values, check whether the allowlist is enforced at registration rather than only at deposit; an active oracle is not equivalent to a whitelisted collateral.