# Valid VFS paths with usernames can always fail validation

VFS path resolution treats usernames that are valid addresses as addresses, bypassing username lookup and causing validation failures or fund misdirection.

- Payout: Contest reward
- Severity: medium
- Program: Andromeda Ado
- Credited: g
- Disclosed: 2024-05-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-05-andromeda-ado-judging/issues/30
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-andromeda-ado%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium technique:source-review vuln:access-control vuln:business-logic

**Target:** Andromeda VFS smart contract
**Root cause:** resolve_home_path and resolve_lib_path call api.addr_validate before checking USERS storage; if a username is also a valid address, the stored address is never loaded, and the username string is used as the address for path resolution.
**Steps:**
1. Register a username like 'username1980' that is also a valid address.
2. Use a VFS path like '/home/username1980/app_contract' in a function that calls get_raw_address().
3. get_raw_address() calls resolve_pathname() -> resolve_home_path(), which calls api.addr_validate('username1980') and succeeds, returning 'username1980' as the address instead of the stored address.
4. resolve_path() then attempts to load paths using 'username1980' as the address, which fails or returns incorrect address.
5. For paths like '/home/username1', resolve_path() returns 'username1' as the address, causing funds to be sent to the wrong address.
**How found:** The auditor noticed that resolve_home_path() and resolve_lib_path() check api.addr_validate() before loading the username from storage, and hypothesized that usernames that are valid addresses would bypass the storage lookup. They verified by modifying a test to use a username that is a valid address.
**Exploitation:** An attacker can register a username that is also a valid address and then use it in VFS paths to cause validation failures or misdirect funds. For example, in Vesting ADO, if the recipient is set to '/home/username1', funds are sent to 'username1' instead of the registered address, resulting in permanent loss.
**Escalation:** The issue affects many parts of AndromedaOS that use get_raw_address() for validation, potentially causing widespread fund loss or denial of service.
**Insight:** When resolving identifiers that can be either addresses or usernames, always check the username registry first, or use a distinct format to avoid ambiguity. Validating an address before checking a registry can lead to bypass if the identifier is also a valid address.