# Unvalidated user-supplied pool or token

User-supplied pool, token, or mint input used in pricing, routing, or collateral without matching it to the real asset

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2022-10-15. Updated 2026-11-06._

## How it works
A contract accepts two things from the caller that must agree: an asset (underlying, token, collateral) and a venue or path that handles it (AMM pool, adapter, swap path, mint manager). It never checks that the venue actually trades that asset. The caller pairs a valuable asset with a pool that does not contain it, or registers a token the protocol never vetted, and the contract's own accounting then moves real value against the fake pairing. The broken assumption is that "the pool I was handed is the pool for this asset" and "the token returned by an external call is an allowed token." Neither is enforced.

## Where it shows up
- Functions taking `underlying`/`asset` plus `pool`, `adapter`, `path`, or `minAmountOut` as independent parameters [E1](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md)
- Swap paths expressed as relative indices (0/1) instead of asset addresses, so the pool need not match the asset [E1](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md)
- Token registration from external call return values (`tokensIn`) without an allowlist check [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md)
- Health/oracle checks used as the only gate, with no `isCollateralAllowed` at registration [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md)
- Mint/convert managers issuing a derivative at a fixed rate with no access control or rate limit [E3](https://bugbountylibrary.com/r/dhl%3A20240813-vow.md)

## How to review
For every caller-supplied venue, trace whether the code proves the venue's tokens equal the asset before pricing or swapping. The invariant: the pool/path/manager used to value or move an asset must be bound to that asset by address, not by position or trust. For registration paths, the invariant: a token becomes collateral only if it passes the same allowlist as a direct deposit; an active oracle is not a whitelist [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md). For mint managers, the invariant: conversion is access-controlled and rate-limited so it cannot be arbitraged against the project's own pools [E3](https://bugbountylibrary.com/r/dhl%3A20240813-vow.md).

## How finders spotted it
- Read `lend()` and noticed pool, paths, and minAmountOut were all user-controlled, and paths used indices 0/1 rather than addresses, so the pool need not match the underlying [E1](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md)
- Read controller return-value handling and `_updateTokensIn`, noticing no allowlist check on `tokensIn` while only the oracle gated health [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md)

## Variants seen
- Same unvalidated-pool flaw across multiple integrations: Tempus (x pool), Sense (adapter), Illuminate (bypass Yield check via supplied principal), Swivel (order) [E1](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md)
- Same auto-registration flaw across UniV2, AaveV2/V3, and Balancer controllers by transferring LP/aTokens and exiting via exec [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md)
- Fixed-rate mint manager enabling flash-swap arbitrage against VOW/WETH and VOW/USDT pools [E3](https://bugbountylibrary.com/r/dhl%3A20240813-vow.md)

## Impact and severity
Stolen protocol fees via zero-slippage swap and sandwich [E1](https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md); inflated collateral from unvetted tokens draining funds [E2](https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md); ~$1M pool drain funded by a flash swap [E3](https://bugbountylibrary.com/r/dhl%3A20240813-vow.md). Impact rises with the value the venue controls and with flash-loan funding that removes capital requirements [E3](https://bugbountylibrary.com/r/dhl%3A20240813-vow.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2022-10-illuminate%3AH-16.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-2.md
- E3: https://bugbountylibrary.com/r/dhl%3A20240813-vow.md