# `AccountV1#flashActionByCreditor` can be used to drain assets from account without withdrawing

AccountV1 allows self-ownership; with a malicious creditor, flashActionByCreditor transfers out ERC721 collateral while accounting still shows it, enabling uncollateralized loans.

- Payout: Contest reward
- Severity: high
- Program: Arcadia
- Credited: 0x52
- Disclosed: 2023-12-17
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-12-arcadia-judging/issues/140
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-arcadia%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** AccountV1 smart contract
**Root cause:** AccountV1 permits an account to be its own owner, and flashActionByCreditor allows the creditor to execute arbitrary actions including _transferFromOwner, which transfers ERC721 assets out without updating erc721Stored.
**Steps:**
1. Deposit an ERC721 (e.g., Uniswap V3 LP) into the account.
2. Set a malicious creditor via openMarginAccount.
3. Transfer the account to itself using factory.safeTransferFrom(owner, account, account).
4. Call flashActionByCreditor on the account with actionData containing transferFromOwnerData for the ERC721; the malicious creditor's executeAction returns empty ActionData, and _transferFromOwner transfers the NFT to the creditor.
5. Use a malicious liquidator to call auctionBoughtIn(attacker) to regain ownership of the account.
6. Set creditor to a legitimate pool and take out a loan against the still-accounted but missing ERC721 collateral.
**How found:** Manual review identified that AccountV1 allows self-ownership and that flashActionByCreditor can be abused with a malicious creditor to transfer assets out without updating internal accounting.
**Exploitation:** Attacker deposits an ERC721, sets a malicious creditor, transfers account ownership to itself, calls flashActionByCreditor to transfer the ERC721 out via _transferFromOwner, then uses a malicious liquidator to call auctionBoughtIn to recover ownership, and finally takes an uncollateralized loan from a legitimate pool.
**Insight:** When a contract can be its own owner, access controls that rely on owner checks may be bypassed; look for self-referential ownership and flash action mechanisms that allow arbitrary calls.