# User can steal rewards from other users by withdrawing their Velo Deposit NFTs from other users' depositors

Any Depositor could burn any DepositReceipt NFT, letting an attacker withdraw their NFT via a victim's Depositor and keep yield accruing to their own.

- Payout: Contest reward
- Severity: high
- Program: Isomorph
- Credited: 0x52
- Disclosed: 2022-11-05
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/51
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Depositor / DepositReceipt NFT (Velodrome gauge staking)
**Root cause:** DepositReceipt.burn only checks _isApprovedOrOwner, not that msg.sender is the Depositor that minted the NFT, so any Depositor can burn any NFT and withdraw its staked amount.
**Steps:**
1. User A and User B each create a Depositor sharing the same DepositReceipt and deposit 100 tokens each.
2. User B calls `withdrawFromGauge(nftIdB, tokens)` on Depositor A instead of their own.
3. Depositor A burns NFT B, calls `gauge.withdraw(100)` and transfers 100 AMMTokens to User B.
4. Depositor B still holds 100 staked tokens in the gauge, so all yield accrues to B while A's Depositor is empty.
**How found:** Code review of Depositor#withdrawFromGauge noticed burn() only enforces ERC721 owner/approval, not minter identity, and that rewards accrue per-Depositor rather than per-NFT.
**Exploitation:** Attacker mints a DepositReceipt NFT on their own Depositor, then calls withdrawFromGauge on a victim's Depositor using that NFT id; the victim's Depositor burns it and withdraws the amount, returning tokens to the attacker while the attacker's Depositor retains the staked balance and collects all rewards.
**Insight:** When NFTs represent positions whose yield accrues to a contract (not the token), check that burn/withdraw paths bind the NFT to the minting contract; shared receipt contracts across per-user proxies are a cross-tenant trust boundary.