# MarginTrading.sol: Missing flash loan initiator check allows attacker to open trades, close trades and steal funds

Missing initiator check in MarginTrading.executeOperation lets anyone initiate a flash loan with MarginTrading as receiver, enabling position closure and fund theft via malicious swap.

- Payout: Contest reward
- Severity: high
- Program: Dodo
- Credited: 0xHati
- Disclosed: 2023-05-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-05-dodo-judging/issues/34
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-dodo%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MarginTrading contract on Aave
**Root cause:** executeOperation only checks msg.sender is lendingPool but not that _initiator is the MarginTrading contract, allowing anyone to initiate a flash loan with MarginTrading as receiver.
**Steps:**
1. Attacker calls Aave LendingPool.flashLoan with receiverAddress = MarginTrading, mode=0, and malicious _params specifying a swap contract.
2. LendingPool transfers borrowed funds to MarginTrading and calls MarginTrading.executeOperation.
3. executeOperation decodes _params and executes swap via attacker-controlled contract, which pockets part of funds.
4. Remaining funds repay debt and withdraw collateral; flash loan repaid from MarginTrading's balance.
**How found:** Realized that Aave flash loans can be initiated for any receiverAddress, not just the initiator, and that repayment is pulled from the receiver, so the missing _initiator check allows arbitrary triggering of executeOperation.
**Exploitation:** Attacker initiates a flash loan with MarginTrading as receiver, using a malicious swap contract in _params to divert part of the borrowed funds, then repays the debt and withdraws collateral to repay the flash loan, profiting at the expense of the MarginTrading position.
**Insight:** When integrating with flash loan protocols, always verify that the initiator is the contract itself, not just that the caller is the lending pool; attackers can set the vulnerable contract as receiver to trigger its callback logic.