# Anyone who approved quote tokens to a pool can be forced to take

Ajna pool take() pulls quote tokens from any approved callee_, letting an attacker force a lender to buy low-value auction collateral.

- Payout: Contest reward
- Severity: high
- Program: Ajna
- Credited: Jeiwan
- Disclosed: 2022-12-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-ajna-judging/issues/145
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ERC20Pool/ERC721Pool take() auction function
**Root cause:** take() pulls quote tokens from the caller-supplied callee_ address rather than msg.sender, so any address with a standing quote-token approval to the pool can be charged.
**Steps:**
1. Lender approves quote token spending to the pool (normal lending flow).
2. Attacker calls `take(..., callee_=lender, ...)` on ERC20Pool/ERC721Pool.
3. Pool transfers quote tokens from lender (L460/L463) and sends auction collateral to lender (L450).
**How found:** Manual code review of take()'s callee_ parameter and noticing quote tokens are pulled from callee_ rather than msg.sender.
**Exploitation:** Attacker specifies a victim lender as callee_ in take(); the pool debits the victim's approved quote tokens to repay the taken debt and delivers the auctioned collateral to the victim, forcing an unwanted purchase.
**Insight:** In auction/liquidation functions, check whether the funding address is caller-controlled separately from msg.sender; standing ERC20 approvals to a pool become an attack surface for forced trades.