# Can steal gOhm by calling Clearinghouse.claimDefaulted on loans not made by Clearinghouse

Clearinghouse.claimDefaulted never verifies loans originated from Clearinghouse, letting attacker mix in self-made loans to inflate keeper rewards and steal gOhm collateral.

- Payout: Contest reward
- Severity: high
- Program: Cooler
- Credited: detectiveking
- Disclosed: 2023-08-17
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-08-cooler-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-08-cooler%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Clearinghouse.claimDefaulted / Cooler lending contract
**Root cause:** claimDefaulted iterates arbitrary factory-created Cooler loans without checking the lender is the Clearinghouse, so keeperRewards is summed across attacker-controlled loans and paid out from the Clearinghouse's gOhm.
**Steps:**
1. Alice deploys a Cooler and calls `requestLoan` 9x for 0.000001 DAI collateralized by 2 gOhm each (duration can be 0s), then `clearLoan` to self.
2. Bob calls `Clearinghouse.lendToCooler` for 3000 DAI collateralized by 1 gOhm.
3. Alice defaults her self-loans; Bob defaults his Clearinghouse loan.
4. Alice calls `Clearinghouse.claimDefaulted(coolers, loans)` passing her 9 loans plus Bob's loan.
5. Each of Alice's loans adds max keeper reward 0.1 gOhm; Bob's adds 0-0.05 gOhm, so Alice receives ~0.9-0.95 gOhm instead of ~0-0.05 gOhm.
**How found:** Code reading of claimDefaulted: noticed only factory.created(coolers_[i]) is validated, no check that the loan's lender is the Clearinghouse, and keeperRewards accumulates per arbitrary loan.
**Exploitation:** Attacker self-originates many tiny defaulted loans with large collateral, then bundles them with a real Clearinghouse defaulted loan in one claimDefaulted call; inflated keeperRewards are transferred to attacker while Clearinghouse burns totalCollateral - keeperRewards, netting ~0.9 gOhm per call (up to 5% of collateral, or 100% via chained issue #115).
**Escalation:** Chained with issue #115 to steal 100% of collateral even without extra gOhm in the Clearinghouse; loan duration 0s reduces setup to one block.
**Insight:** When a batch function aggregates rewards/accounting across user-supplied items, check whether each item's provenance (originator/lender) is validated, not just that it came from a trusted factory; attacker-supplied items can inflate the aggregate payout.