# Unvalidated token or pool address

Caller-supplied token, pool, market or receiver used in transfers, approvals or payout math without a registry or equality check

_Area: Smart contract access control and control flow. Seen in 41 disclosed reports; latest 2025-11-20. Updated 2026-10-23._

## How it works
A function takes an address from the caller — a token, pool, market, receiver, or a field inside a swap payload — and uses it to move funds, grant approvals, or compute payouts. The broken assumption is that this address is the legitimate, registered counterparty, or the same asset the contract already holds. When it is not, the contract approves or spends its own balance, credits the wrong asset, or trusts attacker-controlled data, and funds go to the wrong place.

## Where it shows up
- Functions taking both a deposit token and a user-supplied swap/withdraw payload, where the two token fields are never compared [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19.md).
- Router/aggregator code granting token approvals to a caller-supplied `market` or `spender` [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-47.md).
- Reward/staking managers calling `bucketInfo`/`burnInfo` on an unvalidated `pool_` for payout math [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11.md).
- Account structs that validate an "allowed" config account but never bind it to the actual token account being transferred [E4](https://bugbountylibrary.com/r/sherlock%3A2024-09-orderly-network-solana-contract%3AH-1.md).
- Factory/provenance checks removed or skipped (e.g. "for code size"), letting any contract with the right interface in [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md).
- Whitelisted router calls where only selector/target is pinned, not every calldata field (`srcReceivers`, `dstReceiver`) [E7](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md).
- Code assuming a token is WETH (or similar) without verifying its address [E8](https://bugbountylibrary.com/r/dhl%3A20250628-initcodefactoryfees.md).

## How to review
For every caller-supplied address used in a transfer, approval, or payout calculation, check:
- Registry/provenance: is it validated against a trusted factory or registry before use? [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-47.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md)
- Token equality: does the token actually moved or approved equal the one the contract intended (deposited token, produced token, registered market)? [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AH-4.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-09-orderly-network-solana-contract%3AH-1.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250628-initcodefactoryfees.md)
- Calldata pinning: is every field affecting fund destination constrained, not just the selector? [E7](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md)
Invariant: the address moved/approved must equal the intended, registered one. This differs from generic arbitrary-call bugs: the call target is fixed; the flaw is an unchecked address or field feeding it.

## Variants seen
- Swap payload token mismatch draining contract balances [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AH-4.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19.md).
- Approval granted to fake market address [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-47.md).
- Fake pool feeding reward math [E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11.md).
- Config account not bound to the actual token mint, minting fake value [E4](https://bugbountylibrary.com/r/sherlock%3A2024-09-orderly-network-solana-contract%3AH-1.md).
- Missing factory provenance bricking distribution [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md).
- Unvalidated receiver fields in whitelisted router call [E7](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md).
- Assumed-token identity (fake WETH) draining ETH [E8](https://bugbountylibrary.com/r/dhl%3A20250628-initcodefactoryfees.md).

## Why fixes fail
[E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md) shows a validation removed for code size, leaving downstream calls untrusted. Partial checks that pin only part of the input (selector, one token field) still leave the rest attacker-controlled [E7](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md).

## Impact and severity
High where the address controls approvals or payout math: theft of user and contract assets [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AH-4.md)[E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-47.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-09-orderly-network-solana-contract%3AH-1.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19.md)[E7](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md)[E8](https://bugbountylibrary.com/r/dhl%3A20250628-initcodefactoryfees.md). [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md) is different in kind: a missing provenance check caused a global liveness failure (DoS), worse because one bad address blocks a shared distribution loop. Separate asset loss from liveness when rating severity.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-47.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-11.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-09-orderly-network-solana-contract%3AH-1.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-05-elfi-protocol%3AH-19.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-09.md
- E7: https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.2.3.md
- E8: https://bugbountylibrary.com/r/dhl%3A20250628-initcodefactoryfees.md