# A malicious executor can delete the fees belonging to the owner of `ArrakisStandardManager`

Malicious executor calls rebalance with swap payload invoking claimPoolManagerFees, re-depositing manager fees into pool and zeroing poolManager.

- Payout: Contest reward
- Severity: high
- Program: Arrakis
- Credited: juaan
- Disclosed: 2024-03-02
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-03-arrakis-judging/issues/8
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-1
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic vuln:reward-distribution

**Target:** ArrakisStandardManager rebalance / ValantisHOTModule swap
**Root cause:** rebalance() makes an arbitrary call to the module with executor-supplied payloads; swap()'s arbitrary router call can invoke SovereignPool.claimPoolManagerFees, which sends fees to the module and passes the slippage check, then deposits them back into the pool.
**Steps:**
1. Executor calls `ArrakisStandardManager.rebalance(vault, datas)` with `datas[0] = abi.encodeWithSelector(IValantisHOTModule.swap.selector, zeroForOne, expectedMinReturn=1, amountIn=1, address(pool), 0, 0, payload)`
2. `payload = abi.encodeWithSelector(SovereignPool.claimPoolManagerFees.selector, 0, 0)`
3. swap() withdraws liquidity, then calls `router_.call(payload_)` where router_ is the SovereignPool
4. claimPoolManagerFees sends accrued manager fees to msg.sender (the module), increasing its balance and satisfying the slippage check
5. swap() deposits the resulting balance back into the pool, deleting the manager fees; poolManager is set to address(0)
**How found:** Noticed rebalance() forwards executor payloads to module.call, and swap() performs an arbitrary router call; reasoned that admin functions callable only by the module could be invoked, then identified claimPoolManagerFees as one that increases module balance to bypass the slippage check.
**Exploitation:** A restricted executor abuses the arbitrary call in swap() to invoke claimPoolManagerFees on the SovereignPool, redirecting manager fees to the module and re-depositing them as liquidity, permanently losing them for the manager.
**Escalation:** Also sets poolManager to address(0), causing all onlyPoolManager functions in the pool to revert.
**Insight:** When a contract performs an arbitrary external call with a slippage/min-return check, look for privileged functions on the target that send tokens to the caller—they can satisfy the check while performing unintended state changes.